import type { PolicyDocument, ResolvedConfig } from "./types.js";
export interface PolicySyncResult {
    changed: boolean;
    validated: boolean;
    written: boolean;
    etag?: string;
    backup?: string;
    diff: string;
}
export interface ProvisionResult {
    provisioned: boolean;
    warnings: string[];
    backup?: string;
}
export interface NodeAttrEntry {
    target: string[];
    attr: string[];
}
export declare function nodeAttrsOf(policy: PolicyDocument | undefined): NodeAttrEntry[];
export declare function funnelCovered(policy: PolicyDocument | undefined, tags: string[]): boolean;
export interface SshRuleEntry {
    action: "accept" | "check";
    src: string[];
    dst: string[];
    users: string[];
}
export declare function sshRulesOf(policy: PolicyDocument | undefined): SshRuleEntry[];
export declare function sshCovered(policy: PolicyDocument | undefined, tags: string[]): boolean;
export declare function policySync(config: ResolvedConfig, file: string, options: {
    dryRun: boolean;
    yes: boolean;
    credentialEnvName?: string;
    backupDir?: string;
}): Promise<PolicySyncResult>;
export declare function ensureHttpsEnabled(config: ResolvedConfig, options: {
    yes: boolean;
    credentialEnvName?: string;
}): Promise<ProvisionResult>;
export declare function policyFromEnv(env?: NodeJS.ProcessEnv): string | undefined;
export declare function ensureDeployTags(config: ResolvedConfig, tags: string[], options: {
    yes: boolean;
    credentialEnvName?: string;
    owner?: string[];
    backupDir?: string;
}): Promise<ProvisionResult>;
export declare function ensureFunnelAccess(config: ResolvedConfig, tags: string[], options: {
    yes: boolean;
    credentialEnvName?: string;
    backupDir?: string;
}): Promise<ProvisionResult>;
export declare function ensureSshAccess(config: ResolvedConfig, tags: string[], options: {
    yes: boolean;
    credentialEnvName?: string;
    backupDir?: string;
}): Promise<ProvisionResult>;
//# sourceMappingURL=policy.d.ts.map