import { z } from 'zod';
export type GateDecision = 'allow' | 'deny' | 'review';
export interface GateEvaluationResult {
    readonly decision: GateDecision;
    readonly matchedRule: AuthorizationRule | null;
    readonly reason: string;
}
export type AuthorizationRule = {
    /**
     * Categories this allowance does not reach, even when
     * `isTrustedReadOnly` says the read-only CLAIM is trustworthy.
     * `isTrustedReadOnly` has no notion of category — it answers
     * whether the claim can be believed, never what channel the call
     * travelled over. See `evaluateRule`'s `allow_read_only` case for
     * the category that actually needs this.
     */
    type: 'allow_read_only';
    excludeCategories?: string[];
} | {
    type: 'deny_dangerous_patterns';
} | {
    type: 'allow_by_category';
    categories: string[];
} | {
    type: 'allow_by_name';
    toolNames: string[];
} | {
    type: 'deny_by_name';
    toolNames: string[];
} | {
    /**
     * Match a regular expression against the tool's NAME, the
     * serialised arguments, or both concatenated.
     *
     * Read `target: 'args'` carefully before writing one: it tests
     * `JSON.stringify(toolInput)`, so the subject is the JSON TEXT of
     * the whole argument object — `{"command":"git push origin main"}`
     * — and not any single argument. The name suggests otherwise, and
     * that is what makes it a trap: an anchored pattern like
     * `^git push.*$` is a natural thing to write and can never match,
     * so the rule silently decides nothing. `'both'` PREFIXES the tool
     * name to that text rather than requiring it, so it is not a scope
     * either — a rule written with `bash` in mind still sees every
     * other tool's arguments.
     *
     * When you mean "this tool, this argument", use
     * {@link AuthorizationRule} `argument_pattern` instead. This one
     * stays for the case it is actually good at: matching anywhere in
     * the serialised input without caring where.
     */
    type: 'custom_pattern';
    pattern: string;
    target: 'name' | 'args' | 'both';
    decision: 'allow' | 'deny' | 'review';
} | {
    /**
     * Match a regular expression against ONE named argument of ONE
     * named set of tools.
     *
     * This exists because `custom_pattern` could express neither half.
     * It carries no tool scope, so a rule an operator wrote about
     * `bash` decided `edit` calls too; and its argument target tests
     * the serialised object, so pinning the tool cost the ability to
     * anchor and anchoring cost the tool scope. Every pattern rule was
     * therefore one of those two wrong things.
     *
     * The subject here is the argument's own VALUE, so `^git push`
     * means what it looks like it means.
     *
     * A rule whose tool is not called, or whose argument is absent,
     * decides nothing — the rule's precondition simply is not met. So
     * does one whose argument holds an object or an array: a pattern
     * cannot say anything true about a structured value, and pretending
     * otherwise by matching its serialisation would reintroduce exactly
     * the confusion this rule was added to remove. If you need to
     * refuse a tool over the SHAPE of its input rather than a string in
     * it, deny it by name.
     */
    type: 'argument_pattern';
    toolNames: string[];
    /** The argument key, at the top level of the tool's input. */
    argument: string;
    pattern: string;
    decision: 'allow' | 'deny';
} | {
    type: 'allow_by_tier';
    tiers: string[];
};
export declare const AuthorizationRuleSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
    type: z.ZodLiteral<"allow_read_only">;
    excludeCategories: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    type: "allow_read_only";
    excludeCategories?: string[] | undefined;
}, {
    type: "allow_read_only";
    excludeCategories?: string[] | undefined;
}>, z.ZodObject<{
    type: z.ZodLiteral<"deny_dangerous_patterns">;
}, "strip", z.ZodTypeAny, {
    type: "deny_dangerous_patterns";
}, {
    type: "deny_dangerous_patterns";
}>, z.ZodObject<{
    type: z.ZodLiteral<"allow_by_category">;
    categories: z.ZodArray<z.ZodString, "many">;
}, "strip", z.ZodTypeAny, {
    type: "allow_by_category";
    categories: string[];
}, {
    type: "allow_by_category";
    categories: string[];
}>, z.ZodObject<{
    type: z.ZodLiteral<"allow_by_name">;
    toolNames: z.ZodArray<z.ZodString, "many">;
}, "strip", z.ZodTypeAny, {
    type: "allow_by_name";
    toolNames: string[];
}, {
    type: "allow_by_name";
    toolNames: string[];
}>, z.ZodObject<{
    type: z.ZodLiteral<"deny_by_name">;
    toolNames: z.ZodArray<z.ZodString, "many">;
}, "strip", z.ZodTypeAny, {
    type: "deny_by_name";
    toolNames: string[];
}, {
    type: "deny_by_name";
    toolNames: string[];
}>, z.ZodObject<{
    type: z.ZodLiteral<"custom_pattern">;
    pattern: z.ZodString;
    target: z.ZodEnum<["name", "args", "both"]>;
    decision: z.ZodEnum<["allow", "deny", "review"]>;
}, "strip", z.ZodTypeAny, {
    type: "custom_pattern";
    pattern: string;
    decision: "allow" | "deny" | "review";
    target: "name" | "both" | "args";
}, {
    type: "custom_pattern";
    pattern: string;
    decision: "allow" | "deny" | "review";
    target: "name" | "both" | "args";
}>, z.ZodObject<{
    type: z.ZodLiteral<"argument_pattern">;
    toolNames: z.ZodArray<z.ZodString, "many">;
    argument: z.ZodString;
    pattern: z.ZodString;
    decision: z.ZodEnum<["allow", "deny"]>;
}, "strip", z.ZodTypeAny, {
    type: "argument_pattern";
    pattern: string;
    toolNames: string[];
    decision: "allow" | "deny";
    argument: string;
}, {
    type: "argument_pattern";
    pattern: string;
    toolNames: string[];
    decision: "allow" | "deny";
    argument: string;
}>, z.ZodObject<{
    type: z.ZodLiteral<"allow_by_tier">;
    tiers: z.ZodArray<z.ZodString, "many">;
}, "strip", z.ZodTypeAny, {
    type: "allow_by_tier";
    tiers: string[];
}, {
    type: "allow_by_tier";
    tiers: string[];
}>]>;
export declare const AuthorizationGateConfigSchema: z.ZodObject<{
    enabled: z.ZodDefault<z.ZodBoolean>;
    rules: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
        type: z.ZodLiteral<"allow_read_only">;
        excludeCategories: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    }, "strip", z.ZodTypeAny, {
        type: "allow_read_only";
        excludeCategories?: string[] | undefined;
    }, {
        type: "allow_read_only";
        excludeCategories?: string[] | undefined;
    }>, z.ZodObject<{
        type: z.ZodLiteral<"deny_dangerous_patterns">;
    }, "strip", z.ZodTypeAny, {
        type: "deny_dangerous_patterns";
    }, {
        type: "deny_dangerous_patterns";
    }>, z.ZodObject<{
        type: z.ZodLiteral<"allow_by_category">;
        categories: z.ZodArray<z.ZodString, "many">;
    }, "strip", z.ZodTypeAny, {
        type: "allow_by_category";
        categories: string[];
    }, {
        type: "allow_by_category";
        categories: string[];
    }>, z.ZodObject<{
        type: z.ZodLiteral<"allow_by_name">;
        toolNames: z.ZodArray<z.ZodString, "many">;
    }, "strip", z.ZodTypeAny, {
        type: "allow_by_name";
        toolNames: string[];
    }, {
        type: "allow_by_name";
        toolNames: string[];
    }>, z.ZodObject<{
        type: z.ZodLiteral<"deny_by_name">;
        toolNames: z.ZodArray<z.ZodString, "many">;
    }, "strip", z.ZodTypeAny, {
        type: "deny_by_name";
        toolNames: string[];
    }, {
        type: "deny_by_name";
        toolNames: string[];
    }>, z.ZodObject<{
        type: z.ZodLiteral<"custom_pattern">;
        pattern: z.ZodString;
        target: z.ZodEnum<["name", "args", "both"]>;
        decision: z.ZodEnum<["allow", "deny", "review"]>;
    }, "strip", z.ZodTypeAny, {
        type: "custom_pattern";
        pattern: string;
        decision: "allow" | "deny" | "review";
        target: "name" | "both" | "args";
    }, {
        type: "custom_pattern";
        pattern: string;
        decision: "allow" | "deny" | "review";
        target: "name" | "both" | "args";
    }>, z.ZodObject<{
        type: z.ZodLiteral<"argument_pattern">;
        toolNames: z.ZodArray<z.ZodString, "many">;
        argument: z.ZodString;
        pattern: z.ZodString;
        decision: z.ZodEnum<["allow", "deny"]>;
    }, "strip", z.ZodTypeAny, {
        type: "argument_pattern";
        pattern: string;
        toolNames: string[];
        decision: "allow" | "deny";
        argument: string;
    }, {
        type: "argument_pattern";
        pattern: string;
        toolNames: string[];
        decision: "allow" | "deny";
        argument: string;
    }>, z.ZodObject<{
        type: z.ZodLiteral<"allow_by_tier">;
        tiers: z.ZodArray<z.ZodString, "many">;
    }, "strip", z.ZodTypeAny, {
        type: "allow_by_tier";
        tiers: string[];
    }, {
        type: "allow_by_tier";
        tiers: string[];
    }>]>, "many">>;
    allowReadOnlyTools: z.ZodDefault<z.ZodBoolean>;
    /**
     * Narrows the LAST-resort `allow_read_only` rule the gate appends for
     * {@link allowReadOnlyTools}. A category listed here falls through to
     * whatever comes next — another rule, or review — even for a call
     * `isTrustedReadOnly` would otherwise allow.
     *
     * `.optional()` for the reason `AllowReadOnlySchema.excludeCategories` is.
     */
    allowReadOnlyExcludeCategories: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    denyDangerousPatterns: z.ZodDefault<z.ZodBoolean>;
    logDecisions: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    enabled: boolean;
    rules: ({
        type: "allow_read_only";
        excludeCategories?: string[] | undefined;
    } | {
        type: "deny_dangerous_patterns";
    } | {
        type: "allow_by_category";
        categories: string[];
    } | {
        type: "allow_by_name";
        toolNames: string[];
    } | {
        type: "deny_by_name";
        toolNames: string[];
    } | {
        type: "custom_pattern";
        pattern: string;
        decision: "allow" | "deny" | "review";
        target: "name" | "both" | "args";
    } | {
        type: "argument_pattern";
        pattern: string;
        toolNames: string[];
        decision: "allow" | "deny";
        argument: string;
    } | {
        type: "allow_by_tier";
        tiers: string[];
    })[];
    allowReadOnlyTools: boolean;
    denyDangerousPatterns: boolean;
    logDecisions: boolean;
    allowReadOnlyExcludeCategories?: string[] | undefined;
}, {
    enabled?: boolean | undefined;
    rules?: ({
        type: "allow_read_only";
        excludeCategories?: string[] | undefined;
    } | {
        type: "deny_dangerous_patterns";
    } | {
        type: "allow_by_category";
        categories: string[];
    } | {
        type: "allow_by_name";
        toolNames: string[];
    } | {
        type: "deny_by_name";
        toolNames: string[];
    } | {
        type: "custom_pattern";
        pattern: string;
        decision: "allow" | "deny" | "review";
        target: "name" | "both" | "args";
    } | {
        type: "argument_pattern";
        pattern: string;
        toolNames: string[];
        decision: "allow" | "deny";
        argument: string;
    } | {
        type: "allow_by_tier";
        tiers: string[];
    })[] | undefined;
    allowReadOnlyTools?: boolean | undefined;
    allowReadOnlyExcludeCategories?: string[] | undefined;
    denyDangerousPatterns?: boolean | undefined;
    logDecisions?: boolean | undefined;
}>;
export type AuthorizationGateConfig = z.infer<typeof AuthorizationGateConfigSchema>;
/**
 * Old spellings, live for one deprecation window.
 *
 * A reader who saw `VerificationGate` expected something that verifies a
 * claim — checks a signature, confirms an output matches a schema. This is
 * a rule engine that decides, BEFORE a tool runs, whether the call is
 * permitted: allow / deny / review, by name, category, tier or a pattern
 * over the arguments. Every rule variant says so.
 *
 * The misreading was not academic. The module sat beside real guardrail and
 * HITL neighbours, where "verification" actively suggests the post-hoc
 * double-check the guardrails do.
 */
/**
 * The two schemas below carry aliases too, and the task that specified this
 * rename said they would not need any: `public-runtime.ts` records that they
 * are deliberately not re-exported, so they looked unreachable.
 *
 * They were not. `public-types.ts` re-exports this module with
 * `export type *`, which exports every name in TYPE position — including a
 * `const`. So `import type { VerificationRuleSchema } from '@namzu/sdk'`
 * compiled and `typeof VerificationRuleSchema` was a usable type, while
 * importing it as a value failed with TS1362. Checked by compiling both
 * forms against the built package rather than reading the barrel.
 *
 * Declared as `const` rather than `type` on purpose: a `type` alias would
 * break `typeof`, which is the only way these were ever usable.
 */
//# sourceMappingURL=index.d.ts.map