/**
 * Tool Policy System Types
 *
 * Hierarchical tool grouping and policy management for fine-grained
 * access control. Inspired by OpenClaw's permission model.
 *
 * Key concepts:
 * - ToolGroup: Hierarchical grouping (e.g., 'group:fs:write' is a subset of 'group:fs')
 * - PolicyProfile: Predefined permission sets (minimal, coding, messaging, full)
 * - PolicyDecision: The resolved action for a tool (allow, deny, confirm)
 */
/**
 * Hierarchical tool groups for categorization.
 * Uses colon-separated hierarchy (e.g., 'group:fs:write' inherits from 'group:fs')
 */
export type ToolGroup = 'group:fs' | 'group:fs:read' | 'group:fs:write' | 'group:fs:delete' | 'group:runtime' | 'group:runtime:shell' | 'group:runtime:process' | 'group:web' | 'group:web:fetch' | 'group:web:search' | 'group:git' | 'group:git:read' | 'group:git:write' | 'group:docker' | 'group:kubernetes' | 'group:system' | 'group:system:info' | 'group:system:modify' | 'group:dangerous' | 'group:mcp' | 'group:plugin';
/**
 * All tool groups for iteration
 */
export declare const ALL_TOOL_GROUPS: ToolGroup[];
/**
 * Get parent group from hierarchical group name
 */
export declare function getParentGroup(group: ToolGroup): ToolGroup | null;
/**
 * Check if group is a child of potential parent
 */
export declare function isChildGroup(child: ToolGroup, parent: ToolGroup): boolean;
/**
 * Predefined policy profiles with different permission levels
 */
export type PolicyProfile = 'minimal' | 'coding' | 'messaging' | 'full';
/**
 * Policy action for a tool or group
 */
export type PolicyAction = 'allow' | 'deny' | 'confirm';
/**
 * Policy rule for a tool group
 */
export interface PolicyRule {
    /** Tool group this rule applies to */
    group: ToolGroup;
    /** Action to take */
    action: PolicyAction;
    /** Optional conditions for the rule */
    conditions?: PolicyCondition[];
    /** Priority (higher wins on conflict) */
    priority?: number;
    /** Reason for this policy */
    reason?: string;
}
/**
 * Condition for conditional policy rules
 */
export interface PolicyCondition {
    /** Type of condition */
    type: 'path' | 'command' | 'pattern' | 'time' | 'custom';
    /** Condition value (path glob, regex pattern, etc.) */
    value: string;
    /** Whether to negate the condition */
    negate?: boolean;
}
/**
 * Complete profile definition
 */
export interface ProfileDefinition {
    /** Profile identifier */
    name: PolicyProfile;
    /** Human-readable description */
    description: string;
    /** Rules for this profile */
    rules: PolicyRule[];
    /** Inherit from another profile */
    inherits?: PolicyProfile;
    /** Whether profile can be customized */
    customizable: boolean;
}
/**
 * Decision source for traceability
 */
export type PolicySource = 'profile' | 'global' | 'agent' | 'provider' | 'session' | 'override' | 'default';
/**
 * Result of resolving a policy for a tool
 */
export interface PolicyDecision {
    /** Action to take */
    action: PolicyAction;
    /** Human-readable reason */
    reason: string;
    /** Source of this decision */
    source: PolicySource;
    /** The rule that produced this decision (if any) */
    rule?: PolicyRule;
    /** Confidence (0-1) for logged decisions */
    confidence?: number;
    /** Timestamp of decision */
    timestamp: Date;
}
/**
 * Context for policy resolution
 */
export interface PolicyContext {
    /** Tool being checked */
    toolName: string;
    /** Tool groups the tool belongs to */
    groups: ToolGroup[];
    /** Current agent/mode (if any) */
    agentId?: string;
    /** Provider (for MCP/plugin tools) */
    provider?: string;
    /** Tool arguments (for conditional rules) */
    args?: Record<string, unknown>;
    /** Session-level overrides */
    sessionOverrides?: Map<string, PolicyAction>;
    /** Global overrides */
    globalOverrides?: Map<string, PolicyAction>;
}
/**
 * Tool policy configuration (persisted)
 */
export interface PolicyConfig {
    /** Schema version for migrations */
    version: number;
    /** Active profile */
    activeProfile: PolicyProfile;
    /** Global rule overrides */
    globalRules: PolicyRule[];
    /** Per-agent rule overrides */
    agentRules: Record<string, PolicyRule[]>;
    /** Provider-specific rules */
    providerRules: Record<string, PolicyRule[]>;
    /** Whether to log all policy decisions */
    auditLog: boolean;
    /** Default action for unknown tools */
    defaultAction: PolicyAction;
}
/**
 * Default policy configuration
 */
export declare const DEFAULT_POLICY_CONFIG: PolicyConfig;
/**
 * Policy manager events
 */
export interface PolicyEvents {
    'policy:decision': PolicyDecision & {
        context: PolicyContext;
    };
    'policy:denied': PolicyDecision & {
        context: PolicyContext;
    };
    'policy:profile-changed': {
        from: PolicyProfile;
        to: PolicyProfile;
    };
    'policy:rule-added': {
        rule: PolicyRule;
        source: PolicySource;
    };
    'policy:config-saved': {
        config: PolicyConfig;
    };
    'policy:error': {
        error: Error;
        context?: PolicyContext;
    };
}
