import type { RuntimeAccessSession, RuntimeAccessSessionActorKind, RuntimeAccessSessionGate } from "./runtimeAccessSession.js";
export type ManagementCommandEffect = "read-runtime" | "inspect-runtime" | "invoke-runtime" | "mutate-runtime" | "manage-runtime" | "switch-mode" | "bridge-governance";
export type ManagementPolicyDecisionStatus = "allow" | "deny" | "requires-approval" | "dry-run-only";
export type ManagementPolicyBoundary = "input" | "contract" | "governance" | "runtime-state" | "scope" | "session";
export type ManagementPolicyGateErrorCode = "MISSING_COMMAND" | "MISSING_COMMAND_ID" | "MISSING_COMMAND_NAME" | "MISSING_SESSION" | "SESSION_EXPIRED" | "RUNTIME_MISMATCH" | "RUNTIME_NOT_READY" | "CONTRACT_REJECTED" | "GOVERNANCE_REJECTED" | "EFFECT_NOT_ALLOWED";
export type ManagementCommandEnvelope = {
    runtimeId?: string;
    commandId?: string;
    commandName?: string;
    targetSurface?: string;
    requestedEffects?: readonly ManagementCommandEffect[];
    requiredScopes?: readonly string[];
    dryRun?: boolean;
    metadata?: Readonly<Record<string, unknown>>;
};
export type ManagementPolicyRuleMatch = {
    commandNames?: readonly string[];
    targetSurfaces?: readonly string[];
    effects?: readonly ManagementCommandEffect[];
    actorKinds?: readonly RuntimeAccessSessionActorKind[];
    requiredScopes?: readonly string[];
};
export type ManagementPolicyRule = {
    id: string;
    status: ManagementPolicyDecisionStatus;
    reason?: string;
    priority?: number;
    match?: ManagementPolicyRuleMatch;
    approvalToken?: string;
};
export type ManagementPolicyGateRequest = {
    command?: ManagementCommandEnvelope;
    session?: RuntimeAccessSession;
    rules?: readonly ManagementPolicyRule[];
    allowedEffects?: readonly ManagementCommandEffect[];
    runtimeReady?: boolean;
    nowIso?: string;
    contract?: RuntimeAccessSessionGate;
    governance?: RuntimeAccessSessionGate;
};
export type ManagementPolicyDecision = {
    status: ManagementPolicyDecisionStatus;
    runtimeId: string;
    commandId: string;
    commandName: string;
    targetSurface: string;
    actorId: string;
    actorKind: RuntimeAccessSessionActorKind;
    matchedRuleIds: readonly string[];
    requestedEffects: readonly ManagementCommandEffect[];
    requiredScopes: readonly string[];
    grantedScopes: readonly string[];
    missingScopes: readonly string[];
    reason: string;
    approvalRequired: boolean;
    approvalToken?: string;
    dryRun: true;
    unsafeSideEffects: false;
};
export type ManagementPolicyGateError = {
    code: ManagementPolicyGateErrorCode;
    message: string;
    boundary: ManagementPolicyBoundary;
    safeForApplication: true;
    internalDetailExposed: false;
};
export type ManagementPolicyGateResult = {
    ok: true;
    decision: ManagementPolicyDecision;
    events: readonly string[];
} | {
    ok: false;
    error: ManagementPolicyGateError;
    events: readonly string[];
};
export declare const managementPermissionByEffect: Record<ManagementCommandEffect, string>;
export declare const managementPolicyGateDescriptor: {
    readonly surface: "runtime.managementPlane";
    readonly capability: "managementPolicyGate";
    readonly purpose: "classify management commands against access session scopes and management policy rules";
    readonly mode: "dry-run";
    readonly unsafeSideEffects: false;
};
export declare function evaluateManagementPolicyGate(request?: ManagementPolicyGateRequest): ManagementPolicyGateResult;
