import type { AgentRunRequest, Capability, CapabilityGrant, TaskScope, TaskSpec } from "./types.js";
export declare class PlatformPolicyError extends Error {
    constructor(message: string);
}
export interface RuntimePolicySnapshot {
    sessionId: string;
    workspaceDir?: string;
    allowedPaths: string[];
    disallowedPaths: string[];
    allowedCommands: string[];
    network: NonNullable<TaskScope["network"]>;
    connectors: string[];
    secrets: string[];
    capabilities: Capability[];
}
export interface RuntimePolicy {
    readonly snapshot: RuntimePolicySnapshot;
    assertGrantActive(): void;
    assertCapability(type: Capability["type"], name?: string): void;
    assertPathAllowed(path: string): string;
    assertCommandAllowed(command: string): void;
    assertNetworkAllowed(): void;
    filterEnv(env: Record<string, string | undefined>): Record<string, string | undefined>;
    externalAgentOwnership(): {
        allowedPaths?: string[];
        disallowedPaths?: string[];
        description?: string;
    };
}
export declare function createRuntimePolicy(request: AgentRunRequest): RuntimePolicy;
export declare function createRuntimePolicyFromParts(input: {
    sessionId: string;
    task: TaskSpec;
    grant: CapabilityGrant;
    workspaceDir?: string;
}): RuntimePolicy;
export declare function pathLooksInside(path: string, parent: string): boolean;
//# sourceMappingURL=policy.d.ts.map