/**
 * Permission policies — pure data describing which tools an agent may call.
 *
 * Mirrors `python/src/adk_fluent/_harness/_permissions.py`. Policies are
 * immutable; merging produces a new policy with the union of decisions
 * (deny wins over ask wins over allow).
 */
/** What to do when a tool is invoked. */
export type Decision = "allow" | "ask" | "deny";
/**
 * Coarse permission modes. `DEFAULT` respects the policy's explicit
 * allow/ask/deny rules verbatim. `PLAN` overrides the policy to deny any
 * mutating tool regardless of what the rules say. `ACCEPT_EDITS`
 * auto-allows common edit tools without prompting. `BYPASS` allows
 * everything — used for read-only replay or for tests.
 */
export declare enum PermissionMode {
    DEFAULT = "default",
    PLAN = "plan",
    ACCEPT_EDITS = "accept_edits",
    BYPASS = "bypass"
}
/** Behavior-oriented verdict (matches Python `PermissionBehavior`). */
export declare enum PermissionBehavior {
    ALLOW = "allow",
    ASK = "ask",
    DENY = "deny"
}
/**
 * Rich verdict object returned by `PermissionPolicy.check()`. Mirrors
 * Python's `PermissionDecision`. `behavior` is the canonical field;
 * `isAllow` / `isAsk` / `isDeny` are sugar.
 */
export declare class PermissionDecision {
    readonly behavior: PermissionBehavior;
    readonly reason?: string;
    readonly mode: PermissionMode;
    constructor(behavior: PermissionBehavior, opts?: {
        reason?: string;
        mode?: PermissionMode;
    });
    get isAllow(): boolean;
    get isAsk(): boolean;
    get isDeny(): boolean;
    static allow(reason?: string, mode?: PermissionMode): PermissionDecision;
    static ask(reason?: string, mode?: PermissionMode): PermissionDecision;
    static deny(reason?: string, mode?: PermissionMode): PermissionDecision;
}
export interface PermissionPolicyOptions {
    allow?: Iterable<string>;
    ask?: Iterable<string>;
    deny?: Iterable<string>;
    allowPatterns?: readonly string[];
    denyPatterns?: readonly string[];
    /** "glob" (default) or "regex" — applies to both allow/deny patterns. */
    patternMode?: "glob" | "regex";
    /** Coarse mode that layers on top of allow/ask/deny rules. */
    mode?: PermissionMode;
}
export declare class PermissionPolicy {
    readonly allow: ReadonlySet<string>;
    readonly ask: ReadonlySet<string>;
    readonly deny: ReadonlySet<string>;
    readonly allowPatterns: readonly string[];
    readonly denyPatterns: readonly string[];
    readonly patternMode: "glob" | "regex";
    readonly mode: PermissionMode;
    constructor(opts?: PermissionPolicyOptions);
    /** Decide what to do for a tool call. Default: allow. */
    decide(toolName: string): Decision;
    /**
     * Rich check that returns a `PermissionDecision`. The precedence rules:
     * mode overrides (BYPASS / ACCEPT_EDITS / PLAN) first, then explicit
     * deny, then pattern deny, then explicit ask, then explicit allow, then
     * pattern allow, then a default `allow`.
     */
    check(toolName: string, _args?: Record<string, unknown>): PermissionDecision;
    /** Return a copy of this policy with a different `mode`. */
    withMode(mode: PermissionMode): PermissionPolicy;
    /** Merge with another policy. Deny > ask > allow. Other's mode wins. */
    merge(other: PermissionPolicy): PermissionPolicy;
    private matchAny;
}
/**
 * Persistent record of user approval decisions so the same tool+args
 * pattern isn't asked twice in a session.
 */
export declare class ApprovalMemory {
    private readonly approved;
    private readonly denied;
    /** Approve `toolName` (optionally with a fingerprint of args). */
    approve(toolName: string, fingerprint?: string): void;
    deny(toolName: string, fingerprint?: string): void;
    remembers(toolName: string, fingerprint?: string): "approved" | "denied" | null;
    clear(): void;
    private key;
}
//# sourceMappingURL=permissions.d.ts.map