/**
 * Org sections spec 6.12 and 13.2 (piece P4.2): who stands where, and the policy overlay of each role.
 * Pure; nothing outside the writer files imports it yet. `writer-policy.ts` builds the authority
 * classification, the preflight and the runtime checks on top and is the file callers import.
 *
 * Model. When exactly one section declares non-empty `writes`, that section is the writing section:
 *  - its roles keep their own authority, with `fileWrite` cut down to the section's `writes` globs;
 *  - every other agent role (the root, a lead or member of another section) is made
 *    read-only by the overlay: `fileWrite: []`, `sandbox.mode "required"`, `sandbox.denyWrite` naming the
 *    workspace, its own write grants removed, git no higher than "read".
 * With no writing section (no `writes`, only empty ones, or sections off) there is no overlay.
 */
import type { RolePolicy } from '../types.js';
import { type WriterFinding } from './writer-text.js';
export interface WriterRole {
    id: string;
    type?: string;
    reports_to?: string | null;
    kind?: string;
    runtime?: string;
    policy?: Partial<RolePolicy>;
    tool_providers?: {
        name: string;
        allow?: string[];
    }[];
}
export interface WriterDef {
    name?: string;
    runtime?: string;
    run_config?: Record<string, unknown>;
    sections?: unknown;
    roles: WriterRole[];
}
export interface WriterOptions {
    /** The org root, to compare relative sandbox entries with an absolute workspace. Without it they are undecidable. */
    orgRoot?: string;
    /** The runner roles use when neither the role nor the definition names one (the daemon reads MONOMIND_RUNTIME). */
    defaultRuntime?: string;
}
export type WriterStanding = 'writing-section-lead' | 'writing-section-member' | 'other-section-lead' | 'other-section-member' | 'root' | 'endpoint';
interface SectionInfo {
    name: string;
    lead?: string;
    members: string[];
    writes: string[];
}
export declare const writingSections: (def: WriterDef) => SectionInfo[];
/** Where a role stands: its section (if any), lead or member, and whether that section is the writing one. */
export declare function standingOf(def: WriterDef, roleId: string): {
    standing: WriterStanding;
    section?: string;
};
export interface WriterOverlay {
    role: string;
    standing: WriterStanding;
    section?: string;
    /** Replaces `policy.fileWrite`. */
    fileWrite: string[];
    /** Read-only roles only: replaces `policy.sandbox.mode`, `denyWrite` and (when the role had one) `allowWrite`. */
    sandbox?: {
        mode: 'required';
        denyWrite: string[];
        allowWrite?: string[];
    };
    /** Read-only roles only, and only when the role's own level is above "read". */
    git?: 'read';
}
export interface Plan {
    overlay?: WriterOverlay;
    notes: WriterFinding[];
}
/** The overlay of one role and the findings its own policy earns (a grant that conflicts with the rule). */
export declare function plan(def: WriterDef, roleId: string, opts: WriterOptions): Plan;
/** The policy overlay of one role, or undefined when no overlay applies (see the header). */
export declare function overlayFor(def: WriterDef, roleId: string, opts?: WriterOptions): WriterOverlay | undefined;
/** `policy` with the overlay applied; the same object when there is no overlay. Idempotent. */
export declare function applyWriterOverlay<P extends Partial<RolePolicy> | undefined>(policy: P, overlay: WriterOverlay | undefined): P | Partial<RolePolicy>;
export {};
//# sourceMappingURL=writer-overlay.d.ts.map