/**
 * SkillShield — Network Policy Engine
 *
 * Per-skill domain allowlisting. Skills declare which domains they need,
 * and SkillShield blocks everything else at the DNS resolution level.
 *
 * This is what Snyk and Cisco DON'T do — they scan before install,
 * but can't stop a skill from phoning home at runtime.
 */
export interface NetworkPolicy {
    /** Allowed domains (e.g., ["api.openai.com", "api.anthropic.com"]) */
    allowedDomains: string[];
    /** Allowed IP ranges in CIDR notation (e.g., ["10.0.0.0/8"]) */
    allowedIPs?: string[];
    /** Block all outbound by default? (true = default-deny) */
    defaultDeny: boolean;
    /** Max concurrent connections per skill */
    maxConnections?: number;
    /** Max data transfer in bytes (prevent exfiltration) */
    maxTransferBytes?: number;
    /** Block known malicious IPs/domains */
    blockMalicious?: boolean;
}
export interface NetworkViolation {
    timestamp: string;
    type: 'DNS_BLOCKED' | 'CONNECTION_BLOCKED' | 'TRANSFER_EXCEEDED' | 'MALICIOUS_DOMAIN';
    domain?: string;
    ip?: string;
    port?: number;
    details: string;
}
export declare class NetworkPolicyEngine {
    private policy;
    private violations;
    private connectionCount;
    private transferredBytes;
    private blockedDomains;
    constructor(policy: NetworkPolicy);
    /**
     * Check if a domain is allowed by the policy.
     * Returns true if allowed, false if blocked.
     */
    checkDomain(domain: string): boolean;
    /**
     * Check if a connection attempt is allowed.
     */
    checkConnection(domain: string, port: number): boolean;
    /**
     * Track data transfer and block if limit exceeded.
     */
    trackTransfer(bytes: number): boolean;
    /**
     * Generate the Node.js code that enforces this policy at runtime.
     * This wraps the skill's execution with DNS/network interception.
     */
    generateEnforcementCode(): string;
    private recordViolation;
    getViolations(): NetworkViolation[];
    getStats(): {
        connections: number;
        transferredBytes: number;
        violations: number;
    };
    reset(): void;
}
/**
 * Parse network policy from SKILL.md frontmatter.
 * Expected format in frontmatter:
 *   network:
 *     allowed: ["api.openai.com", "api.anthropic.com"]
 *     maxTransferMB: 10
 */
export declare function parseNetworkPolicy(frontmatter: Record<string, unknown>): NetworkPolicy;
//# sourceMappingURL=network-policy.d.ts.map