import type { SecurityDiffSummary } from "./security-diff.js";
import type { ListSecurityPolicyField, ScalarSecurityPolicyField, SecurityPolicyAffectedAsset, SecurityPolicyBooleanState, SecurityPolicyChangeProvenance, SecurityPolicyTransition } from "./security-policy-diff.js";
import type { SecurityCiPolicyMode } from "./types/configuration.js";
export declare const SECURITY_POLICY_CI_POLICY_SCHEMA_VERSION: "renma.security-policy-ci-policy.v1";
export declare const SECURITY_POLICY_CI_MATCH_IDS: {
    readonly NETWORK_RELAXED: "security_policy_ci.network_relaxed";
    readonly APPROVED_NETWORK_DESTINATION_ADDED: "security_policy_ci.approved_network_destination_added";
    readonly EXTERNAL_UPLOAD_RELAXED: "security_policy_ci.external_upload_relaxed";
    readonly APPROVED_UPLOAD_DESTINATION_ADDED: "security_policy_ci.approved_upload_destination_added";
    readonly ALLOWED_DATA_ADDED: "security_policy_ci.allowed_data_added";
    readonly FORBIDDEN_INPUT_REMOVED: "security_policy_ci.forbidden_input_removed";
    readonly SECRETS_RELAXED: "security_policy_ci.secrets_relaxed";
    readonly HUMAN_APPROVAL_REMOVED: "security_policy_ci.human_approval_removed";
    readonly DISALLOWED_COMMAND_REMOVED: "security_policy_ci.disallowed_command_removed";
};
type SecurityPolicyCiMatchId = (typeof SECURITY_POLICY_CI_MATCH_IDS)[keyof typeof SECURITY_POLICY_CI_MATCH_IDS];
type AllowedValueListProperty = "approvedNetworkDestinations" | "approvedUploadDestinations" | "allowedData";
type RestrictedValueListProperty = Extract<ListSecurityPolicyField, "forbiddenInputs" | "disallowedCommands">;
interface SecurityPolicyRelaxationBase {
    asset: SecurityPolicyAffectedAsset;
    provenance: SecurityPolicyChangeProvenance;
}
interface SecurityPolicyScalarRelaxation extends SecurityPolicyRelaxationBase {
    kind: "scalar";
    property: ScalarSecurityPolicyField;
    direction: "restrictive_state_removed";
    fromState: SecurityPolicyBooleanState;
    toState: SecurityPolicyBooleanState;
}
interface SecurityPolicyAllowedValueRelaxation extends SecurityPolicyRelaxationBase {
    kind: "list";
    property: AllowedValueListProperty;
    direction: "allowed_value_added";
    addedValues: string[];
}
interface SecurityPolicyRestrictedValueRelaxation extends SecurityPolicyRelaxationBase {
    kind: "list";
    property: RestrictedValueListProperty;
    direction: "restricted_value_removed";
    removedValues: string[];
}
type SecurityPolicyRelaxation = SecurityPolicyScalarRelaxation | SecurityPolicyAllowedValueRelaxation | SecurityPolicyRestrictedValueRelaxation;
export type SecurityPolicyCiMatch = SecurityPolicyRelaxation & {
    id: SecurityPolicyCiMatchId;
    summary: string;
};
export interface SecurityPolicyCiConfiguration {
    from: SecurityCiPolicyMode;
    to: SecurityCiPolicyMode;
}
export interface SecurityPolicyCiEvaluation {
    schemaVersion: typeof SECURITY_POLICY_CI_POLICY_SCHEMA_VERSION;
    configured: SecurityPolicyCiConfiguration & {
        effective: SecurityCiPolicyMode;
    };
    outcome: "pass" | "warn" | "fail";
    matchCount: number;
    matches: SecurityPolicyCiMatch[];
}
/** Select the stricter archived-ref mode so a target-only change cannot bypass review. */
export declare function effectiveSecurityPolicyCiPolicy(configured: SecurityPolicyCiConfiguration): SecurityCiPolicyMode;
/** Classify whether a canonical scalar or list transition weakens policy. */
export declare function isSecurityPolicyRelaxation(transition: SecurityPolicyTransition): boolean;
/** Return every independently auditable relaxation in deterministic order. */
export declare function securityPolicyRelaxations(security: {
    policyTransitions?: readonly SecurityPolicyTransition[];
}): SecurityPolicyRelaxation[];
/** Evaluate policy relaxations over canonical matched-asset transitions. */
export declare function evaluateSecurityPolicyCiPolicy(security: Pick<SecurityDiffSummary, "policyTransitions">, configured: SecurityPolicyCiConfiguration): SecurityPolicyCiEvaluation;
export {};