/**
 * Network scope (host/URL) policy rule evaluator with host trust tier classification.
 *
 * NetworkScopeRule matches tool calls that make network requests, restricting
 * or allowing access based on whether the target hostname matches any of the
 * specified host patterns. Supports glob wildcards. Independently testable.
 */
import type { NetworkScopeRule, EvaluationStep } from '../types.js';
import { classifyHostTrustTier, extractHostname, type HostTrustTier, type TrustTierConfig } from '../../../tools/fetch/trust-tiers.js';
/**
 * Re-export host trust tier types from the network scope module for
 * consumers that access trust classification via the permissions layer.
 *
 * The policy panel uses these exports to show host trust classification
 * alongside permission decisions.
 */
export type { HostTrustTier, TrustTierConfig };
export { classifyHostTrustTier, extractHostname };
/** Result returned by evaluateNetworkScopeRule. */
export interface NetworkScopeRuleResult {
    matched: boolean;
    step: EvaluationStep;
}
/**
 * evaluateNetworkScopeRule, Evaluates a single NetworkScopeRule against a tool call.
 *
 * Returns `matched: true` when:
 *   1. The tool name matches the rule's `toolPattern`, AND
 *   2. A network host is found in the args, AND
 *   3. The hostname matches at least one of the rule's `hostPatterns`, AND
 *   4. If `ports` is specified, the request port is in the allowed set.
 *
 * @param rule     - The NetworkScopeRule to evaluate.
 * @param toolName - Name of the tool being called.
 * @param args     - Arguments passed to the tool.
 */
export declare function evaluateNetworkScopeRule(rule: NetworkScopeRule, toolName: string, args: Record<string, unknown>): NetworkScopeRuleResult;
//# sourceMappingURL=network-scope.d.ts.map