/**
 * Tools: sophos_list_policies, sophos_get_policy, sophos_update_policy, sophos_clone_policy,
 *        sophos_create_policy, sophos_delete_policy, sophos_set_policy_assignments
 * Interact with the Sophos Endpoint API /endpoint/v1/policies
 *
 * Assignment (appliesTo) rules measured on a live tenant, 13/10/2026:
 * - appliesTo holds plain ID arrays under users and userGroups (a user policy)
 *   or endpoints and endpointGroups (a device policy). There is no type field;
 *   the kind follows which keys appliesTo carries. {id} objects get a 400.
 * - Mixing user and device keys gets a 400. Server policies take device keys only.
 * - endpointGroups without an endpoints key gets a 500 "Error processing data"
 *   on POST and PATCH; {endpoints: [], endpointGroups: [id]} works.
 * - PATCH replaces the whole assignment: a family key left out comes back empty.
 * - A server endpoint or server group on a computer policy is accepted (201) but
 *   never applies, so the tools look the targets up and refuse the mismatch.
 * - A new policy reaches the list 1.6 to 21.8 s after creation; GET by ID works at once.
 * Web profile rules are in prepareWebProfileSettings.
 */
import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { type SophosClient } from "../client/sophos-client.js";
import type { TenantResolver } from "../client/tenant-resolver.js";
/** A policy's assignment in one family, as the tools name the keys. */
export type PolicyAssignment = {
    kind: "user";
    users: string[];
    user_groups: string[];
} | {
    kind: "device";
    endpoints: string[];
    endpoint_groups: string[];
};
export interface AssignmentArgs {
    users?: string[];
    user_groups?: string[];
    endpoints?: string[];
    endpoint_groups?: string[];
}
/**
 * The family the caller's assignment keys belong to, or undefined when none
 * was passed. Throws, before anything is sent, when user and device keys are
 * mixed (Sophos answers 400) or user keys are aimed at a server policy.
 */
export declare function requestedAssignmentKind(args: AssignmentArgs, policyType?: string): "user" | "device" | undefined;
/** Server policies apply only to endpoints and endpoint groups. */
export declare function assertUserAssignable(policyType: string | undefined): void;
/** The whole assignment the caller asked for; keys left out are empty. */
export declare function assignmentFromArgs(kind: "user" | "device", args: AssignmentArgs): PolicyAssignment;
export declare function emptyAssignment(kind: "user" | "device"): PolicyAssignment;
/**
 * The appliesTo body for an assignment. Both keys of the family are always
 * sent, so endpointGroups never travels without endpoints (that shape gets a
 * 500), and the body says exactly what the stored assignment will be.
 */
export declare function toAppliesTo(a: PolicyAssignment): Record<string, string[]>;
/**
 * Reads a policy's stored appliesTo. Sophos returns plain ID arrays; an
 * {id} object is read too. Returns null when appliesTo carries neither family.
 */
export declare function storedAssignment(appliesTo: unknown): PolicyAssignment | null;
export declare function sameAssignment(a: PolicyAssignment | null, b: PolicyAssignment | null): boolean;
/**
 * Sophos accepts a server endpoint or server group on a computer policy (201,
 * measured 13/10/2026) although it never applies there. Refuses that, the
 * reverse, and IDs the tenant does not have, before anything is written.
 * Security VMs pass either way.
 */
export declare function assertDeviceTargets(client: SophosClient, tenantId: string, policyType: string, args: AssignmentArgs): Promise<void>;
/**
 * Applies the measured web profile rules (13/10/2026) to a settings write:
 * - web-profile-id is ignored (200, no change) unless filter-by-web-profile.enabled
 *   is true in the same write, so it is added; an explicit false is refused.
 * - Clearing the id ("") with filter-by still true gets a 400, so false is added.
 * - web-profile.enabled picks web profiles (true) or legacy settings (false).
 *   Linking a profile turns it on unless the caller set it. On create, Sophos
 *   defaults it to true even with no profile, so a new web control policy gets
 *   it explicitly: true with a profile, false (legacy settings) without.
 * Returns the settings to send and the web profile keys to read back.
 */
export declare function prepareWebProfileSettings(settings: Record<string, unknown> | undefined, createType?: string): {
    settings?: Record<string, unknown>;
    sent: Record<string, unknown>;
};
export declare function registerPolicyTools(server: McpServer, client: SophosClient, tenantResolver: TenantResolver): void;
//# sourceMappingURL=policies.d.ts.map