import { type FabricHostPolicyReplyV1, type FabricHostPolicyV1 } from "../protocol.js";
/**
 * Built-in actions Fabric maintains as free of side effects. Provider-declared
 * risk is never consulted: a provider's own label cannot grant anything. Every
 * other action outside `pi.*` and `extensions.*` needs a host `allowedRefs`
 * entry. Every provider named here is reserved (FABRIC_COMPONENT_PROVIDER_NAMES
 * or `components`), so a third-party provider cannot claim one of these refs;
 * tests/host-policy.test.ts checks that.
 */
export declare const FABRIC_BUILTIN_READ_REFS: ReadonlySet<string>;
/**
 * The one host restriction for a Fabric instance. The host sets it before the
 * instance runs anything; the first program or provider check seals it, so
 * every action Fabric ever admits was checked against the final policy. It
 * lives as long as the extension instance: a new session on the instance keeps
 * it, and /reload builds a new instance that starts without one. Decisions use
 * only the provider and action name, so they run before any provider code,
 * including metadata hooks.
 */
export declare class FabricHostPolicy {
    #private;
    /** True once a policy is in force. Does not seal. */
    get active(): boolean;
    get sealed(): boolean;
    /** Accept the policy only while nothing has run; otherwise refuse it. */
    apply(policy: FabricHostPolicyV1): FabricHostPolicyReplyV1;
    /** Refusal message for `provider.name`, or undefined when the policy allows it. Seals. */
    refDenial(provider: string, name: string): string | undefined;
    /**
     * The same decision as refDenial without sealing, for answers that admit no
     * work, such as which tools a program can reach.
     */
    previewDenial(provider: string, name: string): string | undefined;
    /** True when the policy refuses every action of a provider, so Fabric never lists it. Seals. */
    providerHidden(provider: string): boolean;
    /** Provider visibility without admitting work or sealing the policy. */
    previewProviderHidden(provider: string): boolean;
    /** Native executors run outside every tool hook, so any policy refuses them. Seals. */
    executorDenial(): string | undefined;
}
/** Stable digest of the accepted policy, so a host can match the ack to what it sent. */
export declare const hostPolicyDigest: (policy: FabricHostPolicyV1) => string;
//# sourceMappingURL=host-policy.d.ts.map