/**
 * @name HybridPolicyEngine
 * @description Combines deterministic local guardrails with optional Bento Guard intent scoring.
 *
 * Flow:
 * 1. Local deterministic guardrails always run in hybrid mode.
 * 2. Bento runs only after local checks pass.
 * 3. Bento outages follow the configured fail-open or fail-closed policy.
 * 4. Local-only mode never depends on external services.
 */
import { PolicyConfig, PolicyDecision, PolicyContext } from './local-policy-engine.js';
import { BentoConfig } from './bento-policy-engine.js';
/**
 * @name HybridPolicyConfig
 * @description Runtime configuration for local, Bento-only, and hybrid policy enforcement.
 */
export interface HybridPolicyConfig {
    /** Local policy configuration. */
    local: PolicyConfig;
    /** Optional Bento Guard configuration. */
    bento?: BentoConfig | null;
    /** Policy engine mode. */
    mode: 'local-only' | 'bento-only' | 'hybrid';
    /** Whether policy decisions should be written to the structured logger. */
    logging?: boolean;
    /** Whether Bento outages should allow locally approved requests. */
    failOpen?: boolean;
}
/**
 * @name HybridPolicyEngine
 * @description Runtime service that validates tool calls through local and optional Bento policies.
 */
export declare class HybridPolicyEngine {
    private localEngine;
    private bentoEngine;
    private config;
    private bentoAvailable;
    constructor(config: HybridPolicyConfig);
    /**
     * @name checkBentoAvailability
     * @description Checks Bento Guard availability in the background without blocking server startup.
     */
    private checkBentoAvailability;
    /**
     * @name validateToolCall
     * @description Validates a tool call using the configured policy mode.
     */
    validateToolCall(context: PolicyContext): Promise<PolicyDecision>;
    /**
     * @name validateWithBento
     * @description Validates a tool call exclusively through Bento Guard.
     */
    private validateWithBento;
    /**
     * @name validateWithLocal
     * @description Validates a tool call exclusively through local deterministic policies.
     */
    private validateWithLocal;
    /**
     * @name validateHybrid
     * @description Runs local guardrails first and then Bento Guard when configured.
     */
    private validateHybrid;
    /**
     * @name getEngineUsed
     * @description Returns the policy engine that is expected to have produced the most recent decision.
     */
    private getEngineUsed;
    /**
     * @name logDecision
     * @description Writes a redacted policy decision to the structured logger.
     */
    private logDecision;
    /**
     * @name getStatus
     * @description Returns current hybrid policy health without exposing secrets.
     */
    getStatus(): {
        mode: string;
        bentoConfigured: boolean;
        bentoAvailable: boolean;
        localEngineActive: boolean;
    };
    /**
     * @name refreshBentoStatus
     * @description Forces a Bento Guard availability refresh.
     */
    refreshBentoStatus(): Promise<boolean>;
}
/**
 * @name createHybridPolicyConfigFromEnv
 * @description Creates hybrid policy configuration from SAP MCP environment variables.
 */
export declare function createHybridPolicyConfigFromEnv(): Promise<HybridPolicyConfig>;
//# sourceMappingURL=hybrid-policy-engine.d.ts.map