import type { EngagementScope } from "../store/scope.js";
import type { ToolCall } from "../types.js";
export type ActionCapability = "passive" | "active-enumeration" | "authentication" | "exploitation" | "persistence" | "destructive";
export type EngagementPhase = "recon" | "enumeration" | "authentication" | "exploitation" | "post-exploitation";
export interface EngagementAction {
    target: string;
    url?: string | undefined;
    port?: number | undefined;
    path?: string | undefined;
    method?: string | undefined;
    phase: EngagementPhase;
    capability: ActionCapability;
    redirectChain?: string[] | undefined;
    resolvedAddresses?: string[] | undefined;
}
export interface PolicyDecision {
    allowed: boolean;
    reason: string;
    normalizedTarget: string;
    capability: ActionCapability;
    phase: EngagementPhase;
}
/**
 * Local coding verify (curl/http.fetch to the machine's own loopback) must
 * never be gated by a leftover remote pentest engagement scope.
 * Read-only methods only — POST/PUT/etc. on loopback still go through policy.
 */
export declare function isLocalDevProbeAction(action: EngagementAction): boolean;
export declare function evaluateEngagementAction(scope: EngagementScope | undefined, action: EngagementAction, now?: number): PolicyDecision;
export interface PolicyLease {
    decision: PolicyDecision;
    release: () => void;
}
/** In-memory token bucket/concurrency enforcement; inject clock for deterministic tests. */
export declare class EngagementPolicyEngine {
    private readonly now;
    private tokens;
    private lastRefill;
    private active;
    private scopeIdentity;
    constructor(now?: () => number);
    acquire(scope: EngagementScope | undefined, action: EngagementAction): PolicyLease;
}
export declare function actionFromUrl(input: {
    url: string;
    method?: string | undefined;
    phase?: EngagementPhase | undefined;
    capability?: ActionCapability | undefined;
    redirectChain?: string[] | undefined;
    resolvedAddresses?: string[] | undefined;
}): EngagementAction;
export interface InteractiveEngagementState {
    readonly target?: string | undefined;
    readonly port?: number | undefined;
    readonly phase?: EngagementPhase | undefined;
    readonly capability?: ActionCapability | undefined;
}
export interface InteractiveEngagementAssessment {
    readonly state: InteractiveEngagementState;
    readonly effectful: boolean;
    readonly decision?: PolicyDecision | undefined;
}
export declare function advanceInteractiveEngagementState(current: InteractiveEngagementState, text: string): InteractiveEngagementState;
export declare function evaluateInteractiveEngagementInput(scope: EngagementScope | undefined, current: InteractiveEngagementState, text: string, now?: number): InteractiveEngagementAssessment;
export declare function engagementActionForToolCall(call: ToolCall): EngagementAction | undefined;
/**
 * Every engagement action implied by one tool call — one per distinct network
 * destination. A shell command can name several targets
 * (`nmap in-scope.example.com out-of-scope.example.org`); authorizing only the
 * last one would let the first be scanned unchecked, so callers must evaluate
 * ALL returned actions and deny on the first failure.
 */
export declare function engagementActionsForToolCall(call: ToolCall): EngagementAction[];