import type { ToolDefinition } from '../types/messages.js';
/**
 * Capabilities: what a tool does to the world, written as strings a policy can decide on.
 *
 * | Capability | Means |
 * | --- | --- |
 * | `filesystem:read`, `filesystem:read:<path>` | Reads files, or one path |
 * | `filesystem:write`, `filesystem:write:<path>` | Writes, creates, or deletes files |
 * | `network`, `network:<host or URL>` | Opens a network connection, to a host when given |
 * | `shell`, `shell:<command line>` | Runs a shell command |
 * | `code` | Runs code it was given, as an interpreter does |
 * | `mcp.read:<server>/<tool>` | An MCP tool its server says only reads |
 * | `mcp.write:<server>/<tool>` | An MCP tool its server says changes things but destroys nothing |
 * | `mcp.destructive:<server>/<tool>` | An MCP tool its server says may destroy or overwrite |
 * | `api.read:<api>/<operation>` | An operation of an OpenAPI document whose method only reads |
 * | `api.write:<api>/<operation>` | One whose method changes things |
 * | `api.destructive:<api>/<operation>` | One whose method deletes |
 * | `<name>`, `<name>:<detail>` | Anything the application names, such as `payments:refund` |
 *
 * A tool that declares `capabilities: []` does nothing to the world; one that declares none at all
 * is undeclared, and a policy decides on it as such.
 */
/** One capability, split into its parts. */
export interface ParsedCapability {
    /** `filesystem`, `network`, `shell`, `code`, or the application's own name. */
    kind: string;
    /** `read` or `write`, for the filesystem. */
    access?: 'read' | 'write';
    /** The path, host, command, or detail, when the capability names one. */
    target?: string;
}
/** Splits a capability string into its kind, access, and target. */
export declare function parseCapability(capability: string): ParsedCapability;
/**
 * The capabilities one call of a tool declares: its static list, or what its function computes from
 * the call's arguments. `undefined` means undeclared — no list, or a function that threw — which is
 * not the same as `[]`, a tool that declares it does nothing to the world.
 */
export declare function capabilitiesOf(tool: Pick<ToolDefinition, 'capabilities'> | undefined, args: Record<string, unknown>): string[] | undefined;
/**
 * Whether a capability is sensitive: anything but reading files. A pure tool declares
 * `capabilities: []`; whatever it does declare, a write, a command, code, the network, or an
 * effect of the application's own such as `payments`, changes the world or leaves the process.
 */
export declare function isSensitiveCapability(capability: string): boolean;