import { z } from 'zod';
import type { PolicyConfig } from './policy-types.js';
export declare const PolicyRuleSchema: z.ZodObject<{
    name: z.ZodString;
    description: z.ZodOptional<z.ZodString>;
    action: z.ZodEnum<["block", "flag", "pass"]>;
    tools: z.ZodOptional<z.ZodObject<{
        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    }, "strip", z.ZodTypeAny, {
        allow?: string[] | undefined;
        deny?: string[] | undefined;
    }, {
        allow?: string[] | undefined;
        deny?: string[] | undefined;
    }>>;
    patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    argPatterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
        field: z.ZodString;
        patterns: z.ZodArray<z.ZodString, "many">;
    }, "strip", z.ZodTypeAny, {
        field: string;
        patterns: string[];
    }, {
        field: string;
        patterns: string[];
    }>, "many">>;
    toolCategories: z.ZodOptional<z.ZodObject<{
        deny: z.ZodArray<z.ZodString, "many">;
    }, "strip", z.ZodTypeAny, {
        deny: string[];
    }, {
        deny: string[];
    }>>;
    toolAllowExceptions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    maxTokens: z.ZodOptional<z.ZodNumber>;
    maxCallsPerMinute: z.ZodOptional<z.ZodNumber>;
    maxCallsPer10Seconds: z.ZodOptional<z.ZodNumber>;
    /** Opt-in: allow caching pass decisions for this rule (enterprise policy eval cache). */
    cacheable: z.ZodOptional<z.ZodBoolean>;
    rbac: z.ZodOptional<z.ZodObject<{
        scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        scopeMatch: z.ZodOptional<z.ZodEnum<["any", "all"]>>;
        clientIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        tenants: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    }, "strip", z.ZodTypeAny, {
        tenants?: string[] | undefined;
        scopes?: string[] | undefined;
        clientIds?: string[] | undefined;
        scopeMatch?: "any" | "all" | undefined;
    }, {
        tenants?: string[] | undefined;
        scopes?: string[] | undefined;
        clientIds?: string[] | undefined;
        scopeMatch?: "any" | "all" | undefined;
    }>>;
}, "strip", z.ZodTypeAny, {
    name: string;
    action: "pass" | "block" | "flag";
    description?: string | undefined;
    tools?: {
        allow?: string[] | undefined;
        deny?: string[] | undefined;
    } | undefined;
    maxTokens?: number | undefined;
    argPatterns?: {
        field: string;
        patterns: string[];
    }[] | undefined;
    patterns?: string[] | undefined;
    toolCategories?: {
        deny: string[];
    } | undefined;
    toolAllowExceptions?: string[] | undefined;
    maxCallsPerMinute?: number | undefined;
    maxCallsPer10Seconds?: number | undefined;
    cacheable?: boolean | undefined;
    rbac?: {
        tenants?: string[] | undefined;
        scopes?: string[] | undefined;
        clientIds?: string[] | undefined;
        scopeMatch?: "any" | "all" | undefined;
    } | undefined;
}, {
    name: string;
    action: "pass" | "block" | "flag";
    description?: string | undefined;
    tools?: {
        allow?: string[] | undefined;
        deny?: string[] | undefined;
    } | undefined;
    maxTokens?: number | undefined;
    argPatterns?: {
        field: string;
        patterns: string[];
    }[] | undefined;
    patterns?: string[] | undefined;
    toolCategories?: {
        deny: string[];
    } | undefined;
    toolAllowExceptions?: string[] | undefined;
    maxCallsPerMinute?: number | undefined;
    maxCallsPer10Seconds?: number | undefined;
    cacheable?: boolean | undefined;
    rbac?: {
        tenants?: string[] | undefined;
        scopes?: string[] | undefined;
        clientIds?: string[] | undefined;
        scopeMatch?: "any" | "all" | undefined;
    } | undefined;
}>;
export declare const PolicySchema: z.ZodObject<{
    version: z.ZodString;
    policy: z.ZodObject<{
        mode: z.ZodEnum<["audit", "warn", "block"]>;
        default_action: z.ZodOptional<z.ZodEnum<["pass", "block", "flag"]>>;
        semantic_shell: z.ZodOptional<z.ZodBoolean>;
        unicode_strict: z.ZodOptional<z.ZodBoolean>;
        require_certification: z.ZodOptional<z.ZodEnum<["bronze", "silver", "gold", "platinum"]>>;
        default_sandbox_tier: z.ZodOptional<z.ZodEnum<["shadow", "redact", "allow"]>>;
        rules: z.ZodArray<z.ZodObject<{
            name: z.ZodString;
            description: z.ZodOptional<z.ZodString>;
            action: z.ZodEnum<["block", "flag", "pass"]>;
            tools: z.ZodOptional<z.ZodObject<{
                allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
                deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
            }, "strip", z.ZodTypeAny, {
                allow?: string[] | undefined;
                deny?: string[] | undefined;
            }, {
                allow?: string[] | undefined;
                deny?: string[] | undefined;
            }>>;
            patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
            argPatterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
                field: z.ZodString;
                patterns: z.ZodArray<z.ZodString, "many">;
            }, "strip", z.ZodTypeAny, {
                field: string;
                patterns: string[];
            }, {
                field: string;
                patterns: string[];
            }>, "many">>;
            toolCategories: z.ZodOptional<z.ZodObject<{
                deny: z.ZodArray<z.ZodString, "many">;
            }, "strip", z.ZodTypeAny, {
                deny: string[];
            }, {
                deny: string[];
            }>>;
            toolAllowExceptions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
            maxTokens: z.ZodOptional<z.ZodNumber>;
            maxCallsPerMinute: z.ZodOptional<z.ZodNumber>;
            maxCallsPer10Seconds: z.ZodOptional<z.ZodNumber>;
            /** Opt-in: allow caching pass decisions for this rule (enterprise policy eval cache). */
            cacheable: z.ZodOptional<z.ZodBoolean>;
            rbac: z.ZodOptional<z.ZodObject<{
                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
                scopeMatch: z.ZodOptional<z.ZodEnum<["any", "all"]>>;
                clientIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
                tenants: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
            }, "strip", z.ZodTypeAny, {
                tenants?: string[] | undefined;
                scopes?: string[] | undefined;
                clientIds?: string[] | undefined;
                scopeMatch?: "any" | "all" | undefined;
            }, {
                tenants?: string[] | undefined;
                scopes?: string[] | undefined;
                clientIds?: string[] | undefined;
                scopeMatch?: "any" | "all" | undefined;
            }>>;
        }, "strip", z.ZodTypeAny, {
            name: string;
            action: "pass" | "block" | "flag";
            description?: string | undefined;
            tools?: {
                allow?: string[] | undefined;
                deny?: string[] | undefined;
            } | undefined;
            maxTokens?: number | undefined;
            argPatterns?: {
                field: string;
                patterns: string[];
            }[] | undefined;
            patterns?: string[] | undefined;
            toolCategories?: {
                deny: string[];
            } | undefined;
            toolAllowExceptions?: string[] | undefined;
            maxCallsPerMinute?: number | undefined;
            maxCallsPer10Seconds?: number | undefined;
            cacheable?: boolean | undefined;
            rbac?: {
                tenants?: string[] | undefined;
                scopes?: string[] | undefined;
                clientIds?: string[] | undefined;
                scopeMatch?: "any" | "all" | undefined;
            } | undefined;
        }, {
            name: string;
            action: "pass" | "block" | "flag";
            description?: string | undefined;
            tools?: {
                allow?: string[] | undefined;
                deny?: string[] | undefined;
            } | undefined;
            maxTokens?: number | undefined;
            argPatterns?: {
                field: string;
                patterns: string[];
            }[] | undefined;
            patterns?: string[] | undefined;
            toolCategories?: {
                deny: string[];
            } | undefined;
            toolAllowExceptions?: string[] | undefined;
            maxCallsPerMinute?: number | undefined;
            maxCallsPer10Seconds?: number | undefined;
            cacheable?: boolean | undefined;
            rbac?: {
                tenants?: string[] | undefined;
                scopes?: string[] | undefined;
                clientIds?: string[] | undefined;
                scopeMatch?: "any" | "all" | undefined;
            } | undefined;
        }>, "many">;
    }, "strip", z.ZodTypeAny, {
        rules: {
            name: string;
            action: "pass" | "block" | "flag";
            description?: string | undefined;
            tools?: {
                allow?: string[] | undefined;
                deny?: string[] | undefined;
            } | undefined;
            maxTokens?: number | undefined;
            argPatterns?: {
                field: string;
                patterns: string[];
            }[] | undefined;
            patterns?: string[] | undefined;
            toolCategories?: {
                deny: string[];
            } | undefined;
            toolAllowExceptions?: string[] | undefined;
            maxCallsPerMinute?: number | undefined;
            maxCallsPer10Seconds?: number | undefined;
            cacheable?: boolean | undefined;
            rbac?: {
                tenants?: string[] | undefined;
                scopes?: string[] | undefined;
                clientIds?: string[] | undefined;
                scopeMatch?: "any" | "all" | undefined;
            } | undefined;
        }[];
        mode: "warn" | "block" | "audit";
        default_action?: "pass" | "block" | "flag" | undefined;
        semantic_shell?: boolean | undefined;
        unicode_strict?: boolean | undefined;
        require_certification?: "bronze" | "silver" | "gold" | "platinum" | undefined;
        default_sandbox_tier?: "shadow" | "redact" | "allow" | undefined;
    }, {
        rules: {
            name: string;
            action: "pass" | "block" | "flag";
            description?: string | undefined;
            tools?: {
                allow?: string[] | undefined;
                deny?: string[] | undefined;
            } | undefined;
            maxTokens?: number | undefined;
            argPatterns?: {
                field: string;
                patterns: string[];
            }[] | undefined;
            patterns?: string[] | undefined;
            toolCategories?: {
                deny: string[];
            } | undefined;
            toolAllowExceptions?: string[] | undefined;
            maxCallsPerMinute?: number | undefined;
            maxCallsPer10Seconds?: number | undefined;
            cacheable?: boolean | undefined;
            rbac?: {
                tenants?: string[] | undefined;
                scopes?: string[] | undefined;
                clientIds?: string[] | undefined;
                scopeMatch?: "any" | "all" | undefined;
            } | undefined;
        }[];
        mode: "warn" | "block" | "audit";
        default_action?: "pass" | "block" | "flag" | undefined;
        semantic_shell?: boolean | undefined;
        unicode_strict?: boolean | undefined;
        require_certification?: "bronze" | "silver" | "gold" | "platinum" | undefined;
        default_sandbox_tier?: "shadow" | "redact" | "allow" | undefined;
    }>;
}, "strip", z.ZodTypeAny, {
    version: string;
    policy: {
        rules: {
            name: string;
            action: "pass" | "block" | "flag";
            description?: string | undefined;
            tools?: {
                allow?: string[] | undefined;
                deny?: string[] | undefined;
            } | undefined;
            maxTokens?: number | undefined;
            argPatterns?: {
                field: string;
                patterns: string[];
            }[] | undefined;
            patterns?: string[] | undefined;
            toolCategories?: {
                deny: string[];
            } | undefined;
            toolAllowExceptions?: string[] | undefined;
            maxCallsPerMinute?: number | undefined;
            maxCallsPer10Seconds?: number | undefined;
            cacheable?: boolean | undefined;
            rbac?: {
                tenants?: string[] | undefined;
                scopes?: string[] | undefined;
                clientIds?: string[] | undefined;
                scopeMatch?: "any" | "all" | undefined;
            } | undefined;
        }[];
        mode: "warn" | "block" | "audit";
        default_action?: "pass" | "block" | "flag" | undefined;
        semantic_shell?: boolean | undefined;
        unicode_strict?: boolean | undefined;
        require_certification?: "bronze" | "silver" | "gold" | "platinum" | undefined;
        default_sandbox_tier?: "shadow" | "redact" | "allow" | undefined;
    };
}, {
    version: string;
    policy: {
        rules: {
            name: string;
            action: "pass" | "block" | "flag";
            description?: string | undefined;
            tools?: {
                allow?: string[] | undefined;
                deny?: string[] | undefined;
            } | undefined;
            maxTokens?: number | undefined;
            argPatterns?: {
                field: string;
                patterns: string[];
            }[] | undefined;
            patterns?: string[] | undefined;
            toolCategories?: {
                deny: string[];
            } | undefined;
            toolAllowExceptions?: string[] | undefined;
            maxCallsPerMinute?: number | undefined;
            maxCallsPer10Seconds?: number | undefined;
            cacheable?: boolean | undefined;
            rbac?: {
                tenants?: string[] | undefined;
                scopes?: string[] | undefined;
                clientIds?: string[] | undefined;
                scopeMatch?: "any" | "all" | undefined;
            } | undefined;
        }[];
        mode: "warn" | "block" | "audit";
        default_action?: "pass" | "block" | "flag" | undefined;
        semantic_shell?: boolean | undefined;
        unicode_strict?: boolean | undefined;
        require_certification?: "bronze" | "silver" | "gold" | "platinum" | undefined;
        default_sandbox_tier?: "shadow" | "redact" | "allow" | undefined;
    };
}>;
/** Validate and parse policy YAML/JSON — throws ZodError on invalid config */
export declare function parsePolicyConfig(raw: unknown): PolicyConfig;
//# sourceMappingURL=policy-schema.d.ts.map