import type { TrustPolicy } from '../types/permission.js';
export declare const TRUST_POLICY_SCHEMA_VERSION: 1;
export declare const TRUST_POLICY_LIMITS: Readonly<{
    maxTools: 1000;
    maxPatternsPerRule: 1000;
    maxToolNameChars: 256;
    maxPatternChars: 4096;
}>;
/** Machine-readable schema for the existing unversioned trust.json payload. */
export declare const TRUST_POLICY_JSON_SCHEMA: Readonly<{
    readonly $schema: 'https://json-schema.org/draft/2020-12/schema';
    readonly $id: 'https://wrongstack.dev/schemas/trust-policy-v1.json';
    readonly title: 'WrongStack Trust Policy';
    readonly type: 'object';
    readonly maxProperties: 1000;
    readonly propertyNames: {
        readonly minLength: 1;
        readonly maxLength: 256;
        readonly not: {
            readonly enum: readonly ["__proto__", "prototype", "constructor"];
        };
    };
    readonly additionalProperties: {
        readonly type: 'object';
        readonly additionalProperties: false;
        readonly properties: {
            readonly allow: {
                readonly type: 'array';
                readonly maxItems: 1000;
                readonly items: {
                    readonly type: 'string';
                    readonly minLength: 1;
                    readonly maxLength: 4096;
                };
            };
            readonly deny: {
                readonly type: 'array';
                readonly maxItems: 1000;
                readonly items: {
                    readonly type: 'string';
                    readonly minLength: 1;
                    readonly maxLength: 4096;
                };
            };
            readonly auto: {
                readonly type: 'boolean';
            };
            readonly trustWorkdir: {
                readonly type: 'boolean';
            };
            readonly denyPrivate: {
                readonly type: 'boolean';
            };
        };
    };
}>;
export type TrustPolicyDiagnosticCode = 'invalid_root' | 'invalid_json' | 'read_error' | 'too_many_tools' | 'invalid_tool_name' | 'unsafe_tool_name' | 'invalid_rule' | 'unknown_field' | 'invalid_boolean' | 'invalid_pattern_list' | 'too_many_patterns' | 'invalid_pattern' | 'duplicate_pattern';
export interface TrustPolicyDiagnostic {
    severity: 'error' | 'warning';
    code: TrustPolicyDiagnosticCode;
    path: string;
    message: string;
}
export type TrustPolicyValidationResult = {
    ok: true;
    policy: TrustPolicy;
    diagnostics: TrustPolicyDiagnostic[];
} | {
    ok: false;
    diagnostics: TrustPolicyDiagnostic[];
};
/**
 * Validate and normalize a trust policy. This is the canonical parser shared
 * by runtime enforcement and future policy-inspector/editor surfaces.
 */
export declare function validateTrustPolicy(value: unknown): TrustPolicyValidationResult;
//# sourceMappingURL=permission-policy-schema.d.ts.map