import type { Command, Option, Effects, EnvVar, RiskLevel, ExecutionMode } from "./schema.js";
export type DerivedReadEffect = {
    kind: "option-file";
    option: string;
    path?: string;
    source: string;
} | {
    kind: "semantic";
    target: string;
    description?: string;
    source: string;
};
export type DerivedWriteEffect = {
    kind: "option-file";
    option: string;
    path?: string;
    mode: string;
    source: string;
} | {
    kind: "semantic";
    target: string;
    description?: string;
    overwrite?: boolean;
    destructive?: boolean;
    idempotent?: boolean;
    idempotency_key?: string;
    idempotent_note?: string;
    source: string;
};
export interface DerivedNetworkEffect {
    description?: string;
    domains?: string[];
    idempotent?: boolean;
    idempotency_key?: string;
    idempotent_note?: string;
    source: string;
}
export interface DerivedPolicy {
    risk_level: RiskLevel;
    requires_confirmation: boolean;
    idempotent: boolean;
    side_effects: string[];
    reads: DerivedReadEffect[];
    writes: DerivedWriteEffect[];
    network?: DerivedNetworkEffect[];
    execution_mode?: ExecutionMode;
    requires_secrets?: string[];
}
export interface OptionInput {
    value: unknown;
    specified: boolean;
}
export interface PolicyDerivationInput {
    command_id: string;
    command_effects?: Effects;
    options: Record<string, OptionInput & {
        definition: Option;
    }>;
    env?: Record<string, EnvVar>;
}
export declare function isOptionActive(definition: Option, value: unknown, specified: boolean): boolean;
export declare function derivePolicy(input: PolicyDerivationInput): DerivedPolicy;
export interface IntrospectionResult {
    command: string;
    active_options: string[];
    policy: DerivedPolicy;
}
/**
 * Build introspection result from a command definition and parsed option values.
 * Used by generated --introspect handlers.
 */
export declare function buildIntrospection(commandId: string, command: Command, optionValues: Record<string, unknown>, env?: Record<string, EnvVar>): IntrospectionResult;
//# sourceMappingURL=policy.d.ts.map