import type { SecurityPolicyAssetEvidence, SecurityPolicySource } from "./security-policy-inventory.js";
import type { ArtifactKind } from "./types/artifact.js";
import type { SecurityConfig } from "./types/configuration.js";
export declare const REVIEWABLE_SECURITY_POLICY_FIELDS: readonly ["networkAllowed", "approvedNetworkDestinations", "externalUploadAllowed", "approvedUploadDestinations", "allowedData", "forbiddenInputs", "secretsAllowed", "humanApprovalRequired", "disallowedCommands"];
type ReviewableSecurityPolicyField = (typeof REVIEWABLE_SECURITY_POLICY_FIELDS)[number];
export type ScalarSecurityPolicyField = "networkAllowed" | "externalUploadAllowed" | "secretsAllowed" | "humanApprovalRequired";
export type SecurityPolicyBooleanState = boolean | "unspecified";
export type ListSecurityPolicyField = Exclude<ReviewableSecurityPolicyField, ScalarSecurityPolicyField>;
export interface SecurityPolicyAffectedAsset {
    id: string;
    path: string;
    kind: ArtifactKind;
}
export interface SecurityPolicyChangeSource {
    type: "asset" | "owning_skill" | "security_profile" | "repository_config";
    id: string;
    path?: string;
}
export interface SecurityPolicyChangeProvenance {
    mode: "direct" | "inherited" | "mixed" | "unresolved";
    sources: SecurityPolicyChangeSource[];
}
interface SecurityPolicyScalarChange {
    kind: "scalar";
    field: ScalarSecurityPolicyField;
    before: boolean | null;
    after: boolean | null;
    provenance: SecurityPolicyChangeProvenance;
}
interface SecurityPolicyListChange {
    kind: "list";
    field: ListSecurityPolicyField;
    added: string[];
    removed: string[];
    provenance: SecurityPolicyChangeProvenance;
}
export type SecurityPolicyFieldChange = SecurityPolicyScalarChange | SecurityPolicyListChange;
export interface ReviewableEffectiveSecurityPolicy {
    hasEffectivePolicy: boolean;
    policySources: SecurityPolicySource[];
    selectedSecurityProfile: string | null;
    profileChain: string[];
    allowedData: string[];
    forbiddenInputs: string[];
    networkAllowed: boolean | null;
    externalUploadAllowed: boolean | null;
    secretsAllowed: boolean | null;
    humanApprovalRequired: boolean | null;
    approvedNetworkDestinations: string[];
    approvedUploadDestinations: string[];
    disallowedCommands: string[];
}
export interface SecurityPolicyAssetChange {
    asset: SecurityPolicyAffectedAsset;
    before: ReviewableEffectiveSecurityPolicy | null;
    after: ReviewableEffectiveSecurityPolicy | null;
    fields: SecurityPolicyFieldChange[];
}
interface SecurityPolicyTransitionBase {
    asset: SecurityPolicyAffectedAsset;
    provenance: SecurityPolicyChangeProvenance;
}
/** Canonical matched-asset evidence for one effective boolean policy transition. */
export interface SecurityPolicyScalarTransition extends SecurityPolicyTransitionBase {
    kind: "scalar";
    property: ScalarSecurityPolicyField;
    fromState: SecurityPolicyBooleanState;
    toState: SecurityPolicyBooleanState;
}
/** Canonical matched-asset evidence for one effective list policy transition. */
export interface SecurityPolicyListTransition extends SecurityPolicyTransitionBase {
    kind: "list";
    property: ListSecurityPolicyField;
    added: string[];
    removed: string[];
}
export type SecurityPolicyTransition = SecurityPolicyScalarTransition | SecurityPolicyListTransition;
export interface SharedSecurityPolicyChange {
    source: SecurityPolicyChangeSource & {
        type: "security_profile" | "repository_config";
    };
    changedFields: ReviewableSecurityPolicyField[];
    affectedAssets: SecurityPolicyAffectedAsset[];
}
export interface SecurityPolicyDiffInput {
    fromAssets?: readonly SecurityPolicyAssetEvidence[] | undefined;
    toAssets?: readonly SecurityPolicyAssetEvidence[] | undefined;
    fromConfig?: SecurityConfig | undefined;
    toConfig?: SecurityConfig | undefined;
    fromConfigPath?: string | undefined;
    toConfigPath?: string | undefined;
    fromAssetIdsByPath?: ReadonlyMap<string, string> | undefined;
    toAssetIdsByPath?: ReadonlyMap<string, string> | undefined;
}
export declare function buildSecurityPolicyChanges(input: SecurityPolicyDiffInput): {
    policyChanges: SecurityPolicyAssetChange[];
    policyTransitions: SecurityPolicyTransition[];
    sharedPolicyChanges: SharedSecurityPolicyChange[];
};
export {};