import type { CreateElicitationRequest, CreateElicitationResponse, RequestPermissionRequest, RequestPermissionResponse } from "@agentclientprotocol/sdk";
import type { AcpEventContext } from "./events.js";
/** Async human-in-the-loop decider for ACP permission requests. When present, it REPLACES the
 *  synchronous ToolPolicy path for the sessions it applies to: the agent turn parks until this
 *  resolver selects an ACP permission outcome. It may resolve arbitrarily later (seconds or
 *  minutes); the library guarantees every parked request is settled with the ACP
 *  `{ outcome: { outcome: "cancelled" } }` response when its session is released, its turn is
 *  cancelled via session/cancel, or its connection dies, so teardown can never leave an agent
 *  turn hung behind an unanswered permission prompt. */
export type PermissionResolver = (params: RequestPermissionRequest, ctx: AcpEventContext) => Promise<RequestPermissionResponse> | RequestPermissionResponse;
/** Async human-in-the-loop responder for ACP elicitation/create. ACP marks elicitation
 *  UNSTABLE/@experimental; this library deliberately exposes the SDK request/response types
 *  directly so regular SDK bumps and wire tests catch drift instead of freezing a local copy. */
export type ElicitationResolver = (request: CreateElicitationRequest, context: AcpEventContext) => Promise<CreateElicitationResponse> | CreateElicitationResponse;
/** Codex tool-approval persistence directive (codex-acp `dist/index.js:23952-23975`, §3.6). A
 *  permission decision may ask the agent to REMEMBER the approval for the rest of the session
 *  ("session") or permanently ("always"). It is echoed as `_meta.persist` on the RequestPermission
 *  response; an agent WITHOUT the capability ignores the extra `_meta` (Principle 3 — no silent
 *  unsupported surface). */
export type PermissionPersist = "session" | "always";
/** High-level permission decision (§3.6). Mirrors the spec's `PermissionResolution`: a host says
 *  allow/deny and, on allow, MAY request persistence. `resolvePermission` maps it onto a concrete ACP
 *  `RequestPermissionResponse` (option selection + the `_meta.persist` echo), so a host can drive
 *  `onPermissionRequest` at this altitude instead of hand-building the SDK response. */
export interface PermissionResolution {
    outcome: "allow" | "deny";
    persist?: PermissionPersist;
}
export interface ToolPolicy {
    /** Allow-list (agentType `tools`). When non-empty, a tool that matches NOTHING is denied. */
    allow?: string[];
    /** Deny-list (agentType `disallowedTools`), applied after the allow-list. */
    deny?: string[];
    /** No-match fallback for the headless auto-responder. Default "allow" preserves historical
     *  behavior. Explicit ACP session modes set this to "deny" unless a permission resolver is
     *  present, otherwise read-only/plan confinement can be bypassed by auto-approved escalations. */
    defaultOutcome?: "allow" | "deny";
    /** Codex tool-approval persistence (§3.6): when the auto-responder ALLOWS a tool, echo this as
     *  `_meta.persist` on the response so a capable agent remembers the approval. Ignored on deny and by
     *  agents without the capability. */
    persist?: PermissionPersist;
}
/** Decide the auto-response for one permission request given the tool policy. */
export declare function decidePermission(request: RequestPermissionRequest, policy: ToolPolicy): RequestPermissionResponse;
/** Stamp a persistence directive onto a permission response's top-level `_meta.persist` (§3.6). A
 *  cancelled response, or an absent directive, is returned unchanged. Never mutates the input; a
 *  non-secret structural echo, so it is safe to emit in events. */
export declare function withPersist(response: RequestPermissionResponse, persist: PermissionPersist | undefined): RequestPermissionResponse;
/** Map a high-level `PermissionResolution` (§3.6) onto a concrete ACP `RequestPermissionResponse` for
 *  `request`: pick an allow/reject option of the requested polarity and, on allow, echo `_meta.persist`.
 *  Falls back to CANCELLING when the agent offers no option of the requested polarity (the only way to
 *  refuse a tool with no reject option) — identical to the auto-responder's contract. */
export declare function resolvePermission(request: RequestPermissionRequest, resolution: PermissionResolution): RequestPermissionResponse;
//# sourceMappingURL=permissions.d.ts.map