import { z } from "zod";
export declare const PolicyRuleSchema: z.ZodObject<{
    match: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    action: z.ZodEnum<{
        approve: "approve";
        reject: "reject";
        propagate: "propagate";
    }>;
    rejectMessage: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export type PolicyRule = z.infer<typeof PolicyRuleSchema>;
export declare const PolicySchema: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
    match: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    action: z.ZodEnum<{
        approve: "approve";
        reject: "reject";
        propagate: "propagate";
    }>;
    rejectMessage: z.ZodOptional<z.ZodString>;
}, z.core.$strip>>>;
export type Policy = z.infer<typeof PolicySchema>;
type PolicyResult = {
    type: "approve";
} | {
    type: "reject";
    message?: string;
    value?: string;
} | {
    type: "propagate";
};
/** Escape picomatch metacharacters so a literal value matches only itself
 *  inside a pattern. Used for every value a generated rule pins, and for
 *  the base directory of the built-in scoped policies. */
export declare function escapeGlob(s: string): string;
export declare function checkPolicy(policy: Policy, interrupt: {
    effect: string;
    message: string;
    data: any;
    origin: string;
}, dirs: PolicyDirs): PolicyResult;
/** Like `checkPolicy`, but returns null when NO rule matched — callers that
 * need to distinguish an explicit `propagate` rule from plain fall-through
 * (e.g. the run-policy chain handler, which must stay silent on effects the
 * policy never mentions) use this; everyone else keeps `checkPolicy`'s
 * fall-through-is-propagate contract. */
export declare function checkPolicyExplicit(policy: Policy, interrupt: {
    effect: string;
    message: string;
    data: any;
    origin: string;
}, dirs: PolicyDirs): PolicyResult | null;
/** The directories a `dir` pattern can stand for, resolved once when the
 *  run's context is built (lib/runtime/policyDirs.ts). The matcher takes
 *  them as plain strings and touches no file: it runs while an interrupt is
 *  being answered, and a disk read does not belong on that path. */
export type PolicyDirs = {
    /** Where the agent was launched; what `.` means in a `dir` pattern. */
    cwd: string;
    /** What `<agent-home>` means. */
    agentHome: string;
    /** What `<home>` means: the user's home directory. */
    home: string;
    /** What `<agency>` means, or null when the install root cannot be found
     *  (a bundled build with no package.json above it). The placeholder then
     *  stays as written, so the rule never matches; nothing throws. */
    agencyInstallDir: string | null;
};
export declare function substituteDot(pattern: string, resolvedCwd: string): string;
/** In a `dir` pattern, `<agency>` stands for the directory the agency
 *  package is installed in. A rule approving reads of the shipped docs and
 *  skills can then be saved to a policy file without pinning the install
 *  path of one machine or one version. */
export declare const AGENCY_INSTALL_DIR_PLACEHOLDER = "<agency>";
/** Replace `<agency>` with the resolved install directory, escaped so a
 *  path containing glob or brace characters stays literal. */
export declare function substituteInstallDir(pattern: string, installDir: string | null): string;
/** In a `dir` pattern, `<agent-home>` stands for the agent home directory
 *  (`AGENCY_AGENT_HOME`, or `~/.agency-agent`). The built-in read scope
 *  uses it for the home and everything under it, and the write scope for
 *  the agent's own settings file, so a saved policy keeps meaning
 *  "wherever the agent home is now". */
export declare const AGENT_HOME_PLACEHOLDER = "<agent-home>";
/** Replace `<agent-home>` with the resolved home, escaped the same way. */
export declare function substituteAgentHome(pattern: string, agentHome: string): string;
/** In a `dir` pattern, `<home>` stands for the user's home directory. The
 *  built-in read scope uses it for `~/.claude/skills` only. */
export declare const HOME_PLACEHOLDER = "<home>";
/** Replace `<home>` with the resolved home, escaped the same way. */
export declare function substituteHome(pattern: string, home: string): string;
/** Every directory placeholder in `pattern` replaced by what it means for
 *  this run. `.` is handled apart, by `substituteDot`. */
export declare function substitutePlaceholders(pattern: string, dirs: PolicyDirs): string;
export declare function validatePolicy(policy: any): {
    success: boolean;
    error?: string;
};
export {};