/**
 * RecourseOS Agent Gateway Types - v2 Enforcement Architecture
 *
 * The gateway is the enforcement layer that agents cannot bypass.
 * Key invariant: Agents never receive raw mutation capability.
 * They only receive consequence-aware gateway tools.
 */
export type GateDecision = 'allow' | 'warn' | 'escalate' | 'block';
export type Environment = 'dev' | 'staging' | 'prod';
export type ApprovalStatus = 'pending' | 'approved' | 'rejected' | 'expired';
export type ApprovalMethod = 'sso' | 'slack' | 'servicenow' | 'web_console' | 'github_environment' | 'cli';
export interface GateResult<T = unknown> {
    decision: GateDecision;
    executed: boolean;
    result?: T;
    error?: string;
    report: {
        riskAssessment: GateDecision;
        assessmentReason: string;
        tier: number;
        tierLabel: string;
        mutations: number;
        blastRadius: string[];
    };
    approvalRequired?: boolean;
    approvalId?: string;
    recourseReportId?: string;
    attestationId?: string;
}
export interface ApprovalRequest {
    approvalId: string;
    requestedByAgent: string;
    requestedByUser?: string;
    operation: string;
    target: string;
    environment: Environment;
    planId?: string;
    risk: GateDecision;
    recourseReportId: string;
    blastRadius: string[];
    recoveryPath?: string;
    status: ApprovalStatus;
    createdAt: string;
    expiresAt: string;
    resolution?: {
        humanUserId: string;
        humanEmail?: string;
        groups: string[];
        method: ApprovalMethod;
        reason: string;
        resolvedAt: string;
    };
}
export interface TerraformPlanRecord {
    planId: string;
    planHash: string;
    planJsonHash: string;
    gitSha?: string;
    terraformVersion?: string;
    workspace: string;
    environment: Environment;
    workingDirectory: string;
    createdByAgent: string;
    createdByUser?: string;
    createdAt: string;
    expiresAt: string;
    recourseReportId: string;
    decision: GateDecision;
    approvalId?: string;
    status: 'planned' | 'approved' | 'applied' | 'rejected' | 'expired';
    appliedAt?: string;
}
export interface TerraformPlanInput {
    cwd?: string;
    workspace?: string;
    args?: string[];
    gitSha?: string;
}
export interface TerraformApplyInput {
    planId: string;
}
export interface TerraformDestroyInput {
    cwd?: string;
    workspace?: string;
    args?: string[];
    breakGlass?: boolean;
    breakGlassReason?: string;
}
export interface KubectlReadInput {
    resource?: string;
    name?: string;
    namespace?: string;
    selector?: string;
    allNamespaces?: boolean;
    output?: 'json' | 'yaml' | 'wide' | 'name';
}
export interface KubectlLogsInput {
    pod: string;
    namespace?: string;
    container?: string;
    follow?: boolean;
    tail?: number;
    since?: string;
    previous?: boolean;
}
export interface KubectlApplyInput {
    file?: string;
    manifest?: string;
    namespace?: string;
    dryRun?: 'none' | 'client' | 'server';
}
export interface KubectlDeleteInput {
    resource: string;
    name: string;
    namespace?: string;
    force?: boolean;
    gracePeriod?: number;
}
export interface KubectlScaleInput {
    resource: string;
    name: string;
    namespace?: string;
    replicas: number;
}
export interface KubectlExecInput {
    pod: string;
    namespace?: string;
    container?: string;
    command: string[];
}
export interface KubectlRolloutInput {
    resource: string;
    name: string;
    namespace?: string;
}
export interface ShellExecInput {
    command: string;
    cwd?: string;
    env?: Record<string, string>;
    timeout?: number;
    sandbox?: boolean;
}
export interface ShellPolicy {
    default: 'allow' | 'block' | 'escalate';
    allowReadonly: string[];
    alwaysEscalate: string[];
    alwaysBlock: string[];
    noProductionCredentials: boolean;
    noUnrestrictedNetwork: boolean;
    noSudo: boolean;
    maxTimeout: number;
    redactSecrets: boolean;
}
export interface EnvironmentPolicy {
    defaultMutation: GateDecision;
    terraformDestroy: GateDecision;
    kubectlExec: GateDecision;
    kubectlDelete: GateDecision;
    shell: GateDecision;
}
export interface GatewayPolicy {
    version: string;
    environments: {
        dev: EnvironmentPolicy;
        staging: EnvironmentPolicy;
        prod: EnvironmentPolicy;
    };
    protectedNamespaces: string[];
    protectedWorkspaces: string[];
    alwaysEscalate: string[];
    alwaysBlock: string[];
    shell: ShellPolicy;
    planTtlSeconds: number;
    approvalTtlSeconds: number;
}
export interface CommandResult {
    code: number;
    stdout: string;
    stderr: string;
}
export interface PlanStore {
    save(record: TerraformPlanRecord): Promise<void>;
    get(planId: string): Promise<TerraformPlanRecord | null>;
    updateStatus(planId: string, status: TerraformPlanRecord['status']): Promise<void>;
}
export interface ApprovalStore {
    save(request: ApprovalRequest): Promise<void>;
    get(approvalId: string): Promise<ApprovalRequest | null>;
    approve(approvalId: string, resolution: ApprovalRequest['resolution']): Promise<void>;
    reject(approvalId: string, resolution: ApprovalRequest['resolution']): Promise<void>;
    getExpired(): Promise<ApprovalRequest[]>;
}
export declare const DEFAULT_POLICY: GatewayPolicy;
/** @deprecated Use GatewayPolicy instead */
export interface GatePolicy {
    defaultAction?: GateDecision;
    alwaysEscalate?: string[];
    protectedEnvironments?: string[];
    environment?: string;
    executeOnWarn?: boolean;
    onEscalate?: (result: GateResult) => Promise<boolean>;
    onEvaluate?: (result: GateResult) => void;
}
/** @deprecated Use ShellExecInput instead */
export interface ShellExecOptions {
    cwd?: string;
    env?: Record<string, string>;
    timeout?: number;
}
/** @deprecated Use KubectlApplyInput instead */
export interface KubectlApplyOptions {
    file?: string;
    manifest?: string;
    namespace?: string;
    dryRun?: 'none' | 'client' | 'server';
    args?: string[];
}
/** @deprecated Use TerraformApplyInput instead */
export interface TerraformApplyOptions {
    cwd?: string;
    planFile?: string;
    planJson?: unknown;
    stateJson?: unknown;
    autoApprove?: boolean;
    args?: string[];
}
export interface GateResult<T = unknown> {
    decision: GateDecision;
    executed: boolean;
    result?: T;
    error?: string;
    report: {
        riskAssessment: GateDecision;
        assessmentReason: string;
        tier: number;
        tierLabel: string;
        mutations: number;
        blastRadius: string[];
    };
    approvalRequired?: boolean;
    approvalId?: string;
    recourseReportId?: string;
    attestationId?: string;
}
//# sourceMappingURL=types.d.ts.map