/**
 * Auto-populate the workspace policy. The operator never hand-edits
 * `policy.json`; it is created and maintained here, from `scai setup
 * login`, `scai mcp serve`, and the `scai policy` commands.
 */
import type { EnvironmentConfiguration } from "../config/types.js";
import type { EnrollSource, RiskTier } from "./types.js";
export interface EnrollEnvironmentParams {
    envName: string;
    environment: EnvironmentConfiguration;
    via: EnrollSource;
    /** Ceiling for a newly-enrolled environment. Defaults to `write`. */
    ceiling?: RiskTier;
}
export interface EnrollResult {
    /** True when this call created the policy file (first-ever enrollment). */
    created: boolean;
    /** True when the environment was already enrolled before this call. */
    alreadyEnrolled: boolean;
    /** False when no policy directory is resolvable, so nothing was written. */
    written: boolean;
}
/**
 * Idempotently enroll an environment into the user-global workspace
 * policy. Creates the policy file on first use. Re-enrolling an existing
 * environment refreshes its pinned identity and `enrolledAt` but keeps
 * its original ceiling and `enrolledVia` — re-running login must not
 * silently widen a ceiling the operator narrowed.
 *
 * Never throws on a missing policy directory (Vitest without
 * `SITECOREAI_POLICY_HOME`) — it returns `written: false` instead, so
 * callers in the login / serve paths stay simple.
 */
export declare const enrollEnvironment: (params: EnrollEnvironmentParams) => EnrollResult;
/**
 * Re-pin an already-enrolled environment's identity to whatever the
 * config currently says — the `scai policy trust` path, used after a
 * legitimate tenant change. Returns `false` if the environment is not
 * enrolled or nothing could be written.
 */
export declare const repinEnvironment: (envName: string, environment: EnvironmentConfiguration) => boolean;
/** Remove an environment from the allowlist. Returns `false` if absent. */
export declare const unenrollEnvironment: (envName: string) => boolean;
/** Policy flags an operator may tune on an enrolled environment. */
export interface EnvironmentFlags {
    ceiling?: RiskTier;
    mintCredentials?: boolean;
    ciWrites?: boolean;
    /** Step-up window in minutes; `null` clears it (no requirement). */
    stepUpMinutes?: number | null;
}
/**
 * Explicitly update an enrolled environment's Phase 2 policy flags — the
 * `scai policy set` path. Only the fields provided are changed. Returns
 * `false` if the environment is not enrolled or nothing could be written.
 */
export declare const setEnvironmentFlags: (envName: string, flags: EnvironmentFlags) => boolean;