import type { DirectoryPolicy } from '../types/permission.js';
export declare const DIRECTORY_POLICY_SCHEMA_VERSION: 1;
export declare const DIRECTORY_POLICY_LIMITS: Readonly<{
    maxRules: 500;
    maxDenyToolsPerRule: 256;
    maxDenyProvidersPerRule: 64;
    maxAllowOnlyToolsPerRule: 256;
    maxDirectoryChars: 4096;
    maxDescriptionChars: 1024;
    maxToolNameChars: 256;
    maxProviderIdChars: 128;
}>;
export type DirectoryPolicyDiagnosticCode = 'invalid_root' | 'invalid_schema_version' | 'read_error' | 'too_many_rules' | 'invalid_rule' | 'unknown_field' | 'invalid_directory' | 'invalid_deny_tools' | 'invalid_deny_providers' | 'invalid_allow_only_tools' | 'too_many_deny_tools' | 'too_many_deny_providers' | 'too_many_allow_only_tools' | 'invalid_tool_name' | 'invalid_provider_id' | 'empty_rule' | 'duplicate_rule';
export interface DirectoryPolicyDiagnostic {
    severity: 'error' | 'warning';
    code: DirectoryPolicyDiagnosticCode;
    path: string;
    message: string;
}
export type DirectoryPolicyValidationResult = {
    ok: true;
    policy: DirectoryPolicy;
    diagnostics: DirectoryPolicyDiagnostic[];
} | {
    ok: false;
    diagnostics: DirectoryPolicyDiagnostic[];
};
/**
 * Validate and normalize a directory policy. Mirrors the shape and
 * diagnostics conventions of `validateTrustPolicy` so policy-inspector
 * UIs can render both files with a uniform error model.
 *
 * On invalid input the policy is reported with `ok: false` and the
 * original (untrusted) value is NOT surfaced — callers must treat the
 * returned policy as undefined when ok is false.
 */
export declare function validateDirectoryPolicy(value: unknown): DirectoryPolicyValidationResult;
//# sourceMappingURL=directory-policy-schema.d.ts.map