import type { HiddenPaths, HiddenVars, MountMode, ShowEntry, ShownPaths } from '../types.ts';
/** Whether a document entry is a pattern (any of `*`, `?`, `[`). */
export declare function isGlob(entry: string): boolean;
/**
 * How specific a path entry is: the number of literal components before
 * its first wildcard.
 *
 * The one measure the permissions document's path axis orders by.
 * `/repo/sealed/*` is 2, `/repo/*` and the plain subtree `/repo` are 1,
 * and a slashless name pattern like `*.key` is 0, since it anchors
 * nothing. Every pattern the document allows has an answer, so two
 * entries about one path are always comparable and nothing is ever
 * guessed.
 *
 * It lives here beside `isGlob` rather than in the policy layer because
 * both gates need it: admission scores the rule that covers an operand,
 * and the entry gate scores the rule that covers an entry reached
 * mid-walk.
 */
export declare function anchorDepth(entry: string): number;
/**
 * Compile document path entries into the matcher's shape: glob =
 * pattern, plain = exact subtree, in the order written. The same split
 * serves `paths.hide` and a `CommandRule`'s `paths`, so both planes
 * match through `pathHidden`. Null when there is nothing to match,
 * which is what "unrestricted" reads as.
 */
export declare function classifyPaths(entries: readonly string[]): HiddenPaths | null;
/**
 * Compile document variable entries into the matcher's shape: glob =
 * pattern over names, plain = exact name. Null when empty.
 */
export declare function classifyVars(entries: readonly string[]): HiddenVars | null;
/**
 * Whether a spec has anything at or under this virtual path.
 *
 * Asked for an op that acts on a whole subtree (a rename of a directory,
 * a recursive remove): `/x/locked/*` protects the children of
 * `/x/locked`, and moving or removing `/x/locked` or `/x` takes them
 * along, so the op on the directory or an ancestor counts as touching
 * the scope. Exact entries and the fixed head of an anchored pattern
 * are tested; a component pattern (no `/`) names no place, so only a
 * walk could tell and it is not counted here. With `ancestors` false
 * only the directory holding the scope counts, which is the question for
 * a destination: moving into `/x/locked` lands in the scope, moving into
 * `/x` does not.
 */
export declare function pathCovers(hidden: HiddenPaths | null | undefined, virtual: string, ancestors?: boolean): boolean;
/**
 * The deepest hide entry covering this virtual path, as its anchor
 * depth; null when none does.
 *
 * Depth is a property of the entry, never of where it matched: an
 * anchored pattern that covers a path through an ancestor still scores
 * its own `anchorDepth`, and a component pattern scores 0 wherever it
 * hits, since it anchors nothing.
 */
export declare function hideDepth(hidden: HiddenPaths | null | undefined, virtual: string): number | null;
/**
 * Whether the session's spec hides this virtual path, before any show
 * entry is consulted: what a rule's paths match through, and the hide
 * half of `pathVisible`.
 */
export declare function pathHidden(hidden: HiddenPaths | null | undefined, virtual: string): boolean;
/**
 * The place a show entry anchors to: the entry itself when exact, the
 * fixed directory above its first glob segment when a pattern.
 */
export declare function showHead(entry: string): string;
/**
 * The deepest show entry covering this virtual path, as its anchor
 * depth; null when none does.
 *
 * A show entry is always anchored (validation refuses a slashless
 * pattern), so it covers its own subtree the way an exact hide does; a
 * stray slashless pattern from a typed constructor covers nothing,
 * failing toward refusal.
 */
export declare function showDepth(shown: ShownPaths | null | undefined, virtual: string): number | null;
/**
 * Whether one session's path axis leaves this virtual path visible:
 * the whole composition law for the VFS axis.
 *
 * Three steps, each the anchor-depth rule: no hide covers the path and
 * it is visible; a show covers it more deeply than the deepest hide
 * and it is visible (hide wins the tie); and a hidden directory stays
 * visible when a visible show anchors strictly below it, so the road
 * to a carve-out exists (`hide /repo` + `show /repo/public` keeps
 * `/repo` listable, holding only the carve-out).
 */
export declare function pathVisible(hidden: HiddenPaths | null | undefined, shown: ShownPaths | null | undefined, virtual: string): boolean;
/**
 * The deepest mode-carrying show entry covering this path, as
 * [anchor depth, mode]; null when none does.
 *
 * A list-form entry (mode null) states visibility only and never
 * answers here. Two mode entries at one depth take the weaker, failing
 * toward refusal.
 */
export declare function shownMode(shown: ShownPaths | null | undefined, virtual: string): [number, MountMode] | null;
/**
 * Compile document show entries into the session's shape. Null when
 * there is nothing, which is what "the document states no show" reads
 * as, mirroring `classifyPaths`.
 */
export declare function classifyShows(entries: readonly ShowEntry[]): ShownPaths | null;
/**
 * Whether the spec could hide anything at or under this path.
 *
 * The per-operand gate for a native fast path: a backend's find op or
 * du total classifies the raw tree, so it must not be trusted when a
 * hide could cover an entry inside the subtree it answers for, and can
 * stay on when none can (a hidden `.env` under `/repo` must not force
 * `find` on `/s3` off its native op). A component pattern names no
 * place, so it intersects everything; otherwise an entry intersects
 * when its head lies at or under the path, or the path itself is
 * inside the entry's subtree.
 */
export declare function hidesIntersect(hidden: HiddenPaths | null | undefined, virtual: string): boolean;
/**
 * Whether relocating `src` to `dst` could surface a hidden path.
 *
 * The reveal half of the subtree law: a session's mutation may destroy
 * what it cannot see (`rm -r`, a remnant `rmdir`), but may never reveal
 * it, and a rename or a native directory copy is the relocation that
 * would. Three arms, one per entry kind. A component pattern follows
 * the name wherever the content goes, so it never reveals. An exact
 * entry anchored strictly below `src` re-anchors to `dst` plus its
 * suffix, and reveals when the session would see that mapped path (a
 * show anchored below the mapped path counts, through `pathVisible`'s
 * own carve-out rule). An anchored pattern's coverage does not move
 * with the content, so any pattern whose match space could reach below
 * `src` refuses, failing toward refusal the way `readonlyBelow` blames
 * a pattern.
 */
export declare function moveReveals(hidden: HiddenPaths | null | undefined, shown: ShownPaths | null | undefined, src: string, dst: string): boolean;
/** Whether the session's spec hides this variable name. */
export declare function varHidden(hidden: HiddenVars | null | undefined, name: string): boolean;
//# sourceMappingURL=hidden.d.ts.map