import { type FloatingDependencyAllowance } from "./dependency-selectors.js";
import type { Artifact } from "./types/artifact.js";
import type { ParsedDocument } from "./types/metadata.js";
import type { SecurityConfig } from "./types/configuration.js";
import { type CanonicalSecurityOperationalField } from "./metadata-definitions.js";
import { type SecurityIdentifierAuthority } from "./security-identifier-integrity.js";
interface SecurityPolicyFieldEvidence {
    startLine: number;
    endLine: number;
    snippet: string;
}
export interface SecurityPolicy {
    networkAllowed?: boolean;
    externalUploadAllowed?: boolean;
    secretsAllowed?: boolean;
    humanApprovalRequired?: boolean;
    securityProfile?: string;
    allowedDataClass?: string;
    allowedData: string[];
    forbiddenInputs: string[];
    approvedNetworkDestinations: string[];
    approvedUploadDestinations: string[];
    allowedFloatingDependencies: FloatingDependencyAllowance[];
    disallowedCommands: string[];
    declared: Set<string>;
    invalidDeclared: Set<string>;
    lineByField: Map<string, number>;
    evidenceByField: Map<string, SecurityPolicyFieldEvidence>;
}
type EffectivePolicySource = "local" | "security_profile" | "repository_config";
interface ResolvedSecurityPolicy {
    policy: SecurityPolicy;
    policySources: EffectivePolicySource[];
}
export interface CanonicalSecurityMetadataIssue {
    key: string;
    operationalField?: CanonicalSecurityOperationalField;
    invalidOperationalFields?: readonly CanonicalSecurityOperationalField[];
    reason: string;
    startLine: number;
    endLine: number;
    snippet: string;
    identifierAuthority?: SecurityIdentifierAuthority;
}
interface CanonicalSecurityMetadataResult {
    policy: SecurityPolicy;
    issues: CanonicalSecurityMetadataIssue[];
}
interface SecurityProfileChainItem {
    name: string;
    profile: NonNullable<SecurityConfig["profiles"]>[string];
}
export interface SecurityProfileChain {
    profiles: SecurityProfileChainItem[];
    missingProfile?: string;
    cycle?: string[];
}
export declare function parseSecurityPolicy(content: string): SecurityPolicy;
/** Resolve the operational security source for one repository artifact. */
export declare function parseOperationalSecurityPolicy(input: Artifact | ParsedDocument): SecurityPolicy;
/** Resolve operational policy together with canonical semantic issues. */
export declare function resolveOperationalSecurityPolicy(input: Artifact | ParsedDocument): CanonicalSecurityMetadataResult;
/** Parse and validate every recognized metadata.renma.* security field. */
export declare function validateCanonicalSecurityMetadata(document: ParsedDocument): CanonicalSecurityMetadataResult;
export declare function applySecurityConfig(policy: SecurityPolicy, config?: SecurityConfig): SecurityPolicy;
/** Resolve effective policy and deterministic provenance with one merge pass. */
export declare function resolveSecurityConfig(policy: SecurityPolicy, config?: SecurityConfig): ResolvedSecurityPolicy;
export declare function emptySecurityPolicy(): SecurityPolicy;
export declare function securityProfileChain(name: string | undefined, config: SecurityConfig | undefined): SecurityProfileChain;
export declare function effectiveAllowedDataClass(policy: SecurityPolicy): string | undefined;
export declare function effectiveAllowedDataList(policy: SecurityPolicy): string[];
export declare function isSecurityPolicyLine(line: string): boolean;
export {};