/**
 * Capability Broker
 *
 * Mediates capability requests between agents and sandbox enforcement.
 * Translates trust tier into concrete capabilities and handles runtime
 * capability elevation requests.
 *
 * @packageDocumentation
 */
import { type TierCapabilities, type SandboxConfig, type PolicyViolation } from './types.js';
/**
 * Capability request from an agent
 */
export interface CapabilityRequest {
    /** Unique request ID */
    requestId: string;
    /** Requesting agent CAR ID */
    carId: string;
    /** Current sandbox ID */
    sandboxId: string;
    /** Requested capability type */
    type: CapabilityType;
    /** Specific capability details */
    details: CapabilityDetails;
    /** Justification for the request */
    justification?: string;
    /** Timestamp */
    requestedAt: Date;
}
/**
 * Capability types that can be requested
 */
export type CapabilityType = 'network_egress' | 'filesystem_write' | 'spawn_subprocess' | 'secret_access' | 'agent_communication' | 'extended_runtime' | 'elevated_resources';
/**
 * Specific capability details
 */
export interface CapabilityDetails {
    egressDomain?: string;
    egressPort?: number;
    writePath?: string;
    secretName?: string;
    targetAci?: string;
    additionalMemoryMb?: number;
    additionalCpuPercent?: number;
    additionalTimeMs?: number;
}
/**
 * Capability decision
 */
export interface CapabilityDecision {
    requestId: string;
    granted: boolean;
    reason: string;
    conditions?: CapabilityConditions;
    expiresAt?: Date;
}
/**
 * Conditions attached to a granted capability
 */
export interface CapabilityConditions {
    /** Maximum duration */
    maxDurationMs?: number;
    /** Maximum bytes (for network/disk) */
    maxBytes?: number;
    /** Rate limit */
    rateLimit?: number;
    /** Audit level */
    auditLevel: 'none' | 'summary' | 'detailed' | 'full';
    /** Requires human approval */
    requiresApproval?: boolean;
}
/**
 * Granted capability tracking
 */
export interface GrantedCapability {
    requestId: string;
    type: CapabilityType;
    details: CapabilityDetails;
    conditions: CapabilityConditions;
    grantedAt: Date;
    expiresAt?: Date;
    usageCount: number;
    bytesUsed: number;
}
export declare class CapabilityBroker {
    private grantedCapabilities;
    private pendingRequests;
    constructor();
    /**
     * Get capabilities for a trust tier
     */
    getCapabilitiesForTier(trustTier: number): TierCapabilities;
    /**
     * Check if a tier has a specific capability
     */
    hasCapability(trustTier: number, capability: CapabilityType): boolean;
    /**
     * Request a capability at runtime
     */
    requestCapability(sandboxId: string, config: SandboxConfig, request: Omit<CapabilityRequest, 'requestId' | 'requestedAt'>): Promise<CapabilityDecision>;
    /**
     * Evaluate a capability request
     */
    private evaluateRequest;
    /**
     * Evaluate network egress request
     */
    private evaluateNetworkEgress;
    /**
     * Evaluate filesystem write request
     */
    private evaluateFilesystemWrite;
    /**
     * Evaluate subprocess spawn request
     */
    private evaluateSubprocessSpawn;
    /**
     * Evaluate secret access request
     */
    private evaluateSecretAccess;
    /**
     * Evaluate agent communication request
     */
    private evaluateAgentCommunication;
    /**
     * Evaluate resource elevation request
     */
    private evaluateResourceElevation;
    /**
     * Track a granted capability
     */
    private trackGrantedCapability;
    /**
     * Record capability usage
     */
    recordUsage(sandboxId: string, requestId: string, bytes?: number): void;
    /**
     * Check if a granted capability is still valid
     */
    isCapabilityValid(sandboxId: string, requestId: string): boolean;
    /**
     * Revoke a granted capability
     */
    revokeCapability(sandboxId: string, requestId: string, reason: string): void;
    /**
     * Revoke all capabilities for a sandbox
     */
    revokeAllCapabilities(sandboxId: string): void;
    /**
     * Get all granted capabilities for a sandbox
     */
    getGrantedCapabilities(sandboxId: string): GrantedCapability[];
    /**
     * Handle a policy violation
     */
    handleViolation(sandboxId: string, violation: PolicyViolation): {
        action: 'warn' | 'revoke' | 'terminate';
        reason: string;
    };
    private getEgressBytesLimit;
    private getRateLimit;
    private getDiskQuota;
}
export declare function createCapabilityBroker(): CapabilityBroker;
export declare function getCapabilityBroker(): CapabilityBroker;
//# sourceMappingURL=capability-broker.d.ts.map