import type { CommonPermissions, ResolvedRole } from './config.js';
import type { UnattendedCapability } from './harness/types.js';
/**
 * The capability floor every unattended role must clear. These are not
 * nice-to-haves: an agent that cannot read its briefing, append its worklog,
 * bind its identity, arm its monitor, edit its workspace, or run the status
 * commands its briefing prescribes cannot carry out the job it was spawned for
 * — and, being unattended, will report no error while failing to.
 */
export declare const UNATTENDED_FLOOR: readonly UnattendedCapability[];
/** Fleet-owned wake delivery removes the native Monitor-tool requirement. */
export declare function requiredUnattendedFloor(role: ResolvedRole): readonly UnattendedCapability[];
export interface FloorResult {
    meets: boolean;
    missing: UnattendedCapability[];
}
/** Which floor capabilities a set of granted capabilities fails to cover. */
export declare function checkUnattendedFloor(granted: readonly UnattendedCapability[], required?: readonly UnattendedCapability[]): FloorResult;
/**
 * One role's neutral permissions, resolved through its harness adapter.
 *
 * Both `ours-fleet config` and `ours-fleet doctor` render this same object, so
 * the two commands cannot disagree about what a configuration actually means.
 * Before this existed, `translatePermissions()` was implemented by every
 * adapter and called by nobody: the warnings it produced — including "this
 * combination is not represented exactly" — were unreachable.
 */
export interface RolePermissionAnalysis {
    role: string;
    harness: string;
    permissions: CommonPermissions;
    /** Whether the harness can express neutral permissions at all. */
    supported: boolean;
    /** The harness's own settings, when it can. */
    native?: Record<string, unknown>;
    /** Whether those settings represent the neutral intent exactly. */
    exact?: boolean;
    /** What the native settings actually permit an unattended agent to do. */
    capabilities?: UnattendedCapability[];
    /** Whether those capabilities clear the unattended floor. */
    floor?: FloorResult;
    /**
     * How hard a floor shortfall is. A role that auto-denies (`unattended: deny`)
     * silently does less than asked, so that is a failure; one that waits can at
     * least be rescued by a human attaching a console, so that is a warning.
     */
    floorSeverity?: 'fail' | 'warn';
    /** Native settings that contradict the neutral block; empty when they agree. */
    conflicts?: PermissionConflict[];
    /** A role-named line when the floor is not met; absent when it is. */
    floorWarning?: string;
    /** Role-named translation warnings, ready to print verbatim by any command. */
    warnings: string[];
}
export interface PermissionConflict {
    /** The native setting both sources speak to, e.g. `permission_mode`. */
    key: string;
    /** What the neutral `permissions:` block translates to. */
    fromNeutral: string;
    /** What `harness_options` states directly. */
    fromNative: string;
    /** The role-named line commands print. */
    warning: string;
}
/** Resolve the effective portable policy after harness-native overrides win. */
export declare function effectivePermissionMode(role: ResolvedRole): {
    fleetMode: import('./config.js').FleetPermissionMode;
    nativeMode: string;
};
/** Preserve configured intent when a managed child inherits from its caller. */
export declare function inheritedPermissionMode(role: ResolvedRole): import('./config.js').FleetPermissionMode;
/** Resolve one role's permissions through its adapter. Never throws. */
export declare function analyzeRolePermissions(role: ResolvedRole): RolePermissionAnalysis;
/** Every line a command should show for a role: translation, conflicts, floor. */
export declare function allWarnings(a: RolePermissionAnalysis): string[];
/** Resolve every role's permissions, in config order. */
export declare function analyzeFleetPermissions(roles: ResolvedRole[]): RolePermissionAnalysis[];
/** Render an analysis's native settings compactly, for one-line reporting. */
export declare function formatNative(native: Record<string, unknown> | undefined): string;