/**
 * HTTP tool exposure policy.
 *
 * The stdio transport (local Claude Code) gets every tool; the HTTP
 * transport is a remote attack surface, so by default it may only
 * invoke tools registered with readOnlyHint: true. A leaked bearer
 * token must not be equivalent to file writes or process execution.
 *
 * VASPERA_HTTP_TOOLS controls the policy:
 *   - "readonly" (default): only readOnlyHint tools
 *   - "all": every tool (not recommended)
 *   - comma-separated tool names: explicit allowlist
 *
 * @module http-policy
 */
export interface HttpToolPolicy {
    mode: "readonly" | "all" | "allowlist";
    allowlist: ReadonlySet<string>;
}
export declare function resolveToolPolicy(env?: NodeJS.ProcessEnv): HttpToolPolicy;
export declare function isToolAllowed(name: string, policy: HttpToolPolicy): boolean;
/**
 * Find the first tools/call in a JSON-RPC payload (single or batch)
 * that the policy forbids. Returns null when everything is allowed.
 */
export declare function findBlockedToolCall(payload: unknown, policy: HttpToolPolicy): {
    toolName: string;
    id: unknown;
} | null;
//# sourceMappingURL=http-policy.d.ts.map