import type { SafetyRule } from './types.js';
import type { SafetyEvaluation } from './types.js';
/**
 * Safety levels for preventing destructive operations.
 *
 * - NONE: No safety restrictions (default)
 * - NO_DELETE: Block DELETE operations only
 * - NO_UPDATE: Block DELETE and destructive operations (reset, stop, restart)
 * - READ_ONLY: Block all write operations (only GET allowed)
 */
export type SafetyLevel = 'NONE' | 'NO_DELETE' | 'NO_UPDATE' | 'READ_ONLY';
/**
 * Safety configuration.
 *
 * Supports both simple level-based blocking and granular per-rule actions.
 */
export interface SafetyConfig {
    /** The base safety level. */
    level: SafetyLevel;
    /** When true, operations that the level would block require confirmation instead of hard-blocking. */
    confirm?: boolean;
    /** Ordered list of rules. First matching rule wins. */
    rules?: SafetyRule[];
}
/**
 * Returns the more restrictive of two safety levels.
 */
export declare function maxSafetyLevel(a: SafetyLevel, b: SafetyLevel): SafetyLevel;
/**
 * Check if a string is a valid SafetyLevel.
 */
export declare function isValidSafetyLevel(value: string): value is SafetyLevel;
/**
 * Parse a string to a SafetyLevel, returning undefined for invalid values.
 * Accepts case-insensitive input and converts dashes to underscores.
 */
export declare function parseSafetyLevelString(value: string | undefined): SafetyLevel | undefined;
/**
 * Safety error thrown when an operation is blocked by safety configuration.
 */
export declare class SafetyBlockedError extends Error {
    readonly method: string;
    readonly url: string;
    readonly safetyLevel: SafetyLevel;
    constructor(message: string, method: string, url: string, safetyLevel: SafetyLevel);
}
/**
 * Error thrown when an operation requires interactive confirmation.
 *
 * Callers can catch this error, prompt the user, and retry the operation
 * using {@link withSafetyConfirmation}.
 */
export declare class SafetyConfirmationRequired extends Error {
    readonly evaluation: SafetyEvaluation;
    constructor(evaluation: SafetyEvaluation);
}
/**
 * Checks if an HTTP operation should be blocked based on a safety level.
 *
 * This is the low-level level check. For full rule-based evaluation,
 * use {@link SafetyGuard.evaluate}.
 *
 * @param method - HTTP method (GET, POST, PUT, PATCH, DELETE)
 * @param path - URL pathname
 * @param level - Safety level to check against
 * @returns Error message if blocked, undefined if allowed
 */
export declare function checkLevelViolation(method: string, path: string, level: SafetyLevel): string | undefined;
/**
 * Checks if an HTTP operation should be blocked based on safety configuration.
 *
 * @param method - HTTP method (GET, POST, PUT, PATCH, DELETE)
 * @param url - Request URL
 * @param config - Safety configuration
 * @returns Error message if blocked, undefined if allowed
 * @deprecated Use {@link SafetyGuard.evaluate} for full rule-based evaluation.
 */
export declare function checkSafetyViolation(method: string, url: string, config: SafetyConfig): string | undefined;
/**
 * Parse safety level from environment variable.
 *
 * Reads from SFCC_SAFETY_LEVEL. Valid values: NONE, NO_DELETE, NO_UPDATE, READ_ONLY
 * (case-insensitive; dashes converted to underscores). Invalid values are logged
 * as a warning and the default level is returned.
 *
 * @param defaultLevel - Default level if no environment variable is set or value is invalid
 * @returns Parsed safety level
 */
export declare function getSafetyLevel(defaultLevel?: SafetyLevel): SafetyLevel;
/**
 * Get a user-friendly description of the safety level.
 */
export declare function describeSafetyLevel(level: SafetyLevel): string;
/** Validated safety config fragment (shared by global and per-instance). */
export interface SafetyConfigFragment {
    level?: SafetyLevel;
    confirm?: boolean;
    rules?: SafetyRule[];
}
/**
 * Load global safety configuration from a JSON file.
 *
 * Resolution order:
 * 1. `SFCC_SAFETY_CONFIG` env var — explicit path to a safety config file
 * 2. `{configDir}/safety.json` — oclif config directory (e.g., `~/.config/b2c/safety.json`)
 *
 * The file has the same shape as the `safety` object in dw.json:
 * ```json
 * { "level": "NO_DELETE", "confirm": true, "rules": [...] }
 * ```
 *
 * @param configDir - oclif config directory path (e.g., `this.config.configDir`)
 * @returns Validated safety config fragment, or undefined if no file found
 */
export declare function loadGlobalSafetyConfig(configDir?: string): SafetyConfigFragment | undefined;
/**
 * Compute effective safety config by merging environment variables, global
 * safety config, and per-instance config.
 *
 * Merge strategy:
 * - **Level**: `max(env, global, instance)` — most restrictive wins
 * - **Confirm**: OR across all sources
 * - **Rules**: instance rules first, then global rules (first-match-wins,
 *   so instance rules can override global policy)
 *
 * @param instanceSafety - Per-instance safety config from dw.json
 * @param globalSafety - Global safety config from safety.json
 * @returns Merged SafetyConfig
 */
export declare function resolveEffectiveSafetyConfig(instanceSafety?: SafetyConfigFragment, globalSafety?: SafetyConfigFragment): SafetyConfig;