import { AgentId } from "./compat/codecs.mjs";
import { t as AgentPermissionPolicy } from "./schema-DttwJpw-.mjs";

//#region src/api.d.ts
/** Supported format identifiers, including canonical. */
type Format = AgentId | "canonical";
/** Result of a successful conversion. */
interface ConvertResult {
  /** The converted output (agent-native JSON object). */
  output: unknown;
  /** The format that was decoded from (auto-detected or explicit). */
  from: Format;
  /** Number of rules in the intermediate canonical representation. */
  ruleCount: number;
}
/** Result of validating a policy. */
interface ValidateResult$1 {
  /** Whether the policy is valid. */
  valid: boolean;
  /** Validation errors (empty when valid). */
  errors: ValidationError[];
}
/** Result of checking a tool call against a policy. */
interface CheckResult {
  /** The evaluation decision. */
  decision: "allow" | "deny" | "ask";
}
/**
 * Detect the agent format from a file path.
 *
 * Matches against known config file names:
 *   - `.claude/settings.json` or `.claude/settings.local.json` → claude-code
 *   - `opencode.json` → opencode
 *   - `.kiro/permissions.json` → kiro
 *   - `codex.toml` → codex
 *   - `.agents/permissions.json` or `.agents/permissions.local.json` → canonical
 */
declare function detectFormatFromPath(filePath: string): Format | undefined;
/**
 * Resolve a format specifier that may be an agent name or a file path.
 *
 * Returns the format if it's a known agent name.
 * Returns the detected format if it's a known config file path.
 * Returns undefined if neither.
 */
declare function resolveFormat(spec: string): Format | undefined;
/**
 * Detect the agent format from parsed JSON content.
 *
 * Distinguishing features:
 *   canonical — `rules` array of {tool, tier} objects, or top-level `permissions`, `sandbox`, `profiles`, etc.
 *   claude-code — `allow`/`deny`/`ask` arrays of plain strings, `additionalDirectories`
 *   crush — `allowed_tools` (required) array of plain strings
 *   kiro — `allowedTools` or `toolsSettings`
 *   codex — `approval_policy`, `sandbox_mode`, `permissions` (record of named profiles)
 *   opencode — bare "allow"/"deny" string, or object with lowercase tool keys (bash, read, edit, …)
 */
declare function detectFormat(value: unknown): Format | undefined;
/**
 * Convert a permission config between agent formats.
 *
 * @param from - Source format. Omit or `undefined` to auto-detect.
 * @param to - Target format (required).
 * @param json - Parsed JSON input (any agent-native or canonical object).
 * @returns Conversion result with output, detected format, and rule count.
 * @throws Error on invalid input, unknown format, or codec failure.
 */
declare function convert(from: Format | undefined, to: Format, json: unknown): ConvertResult;
/**
 * Validate a parsed JSON object against the canonical policy schema.
 *
 * @param json - Parsed JSON to validate.
 * @returns Validation result with errors array (empty when valid).
 */
declare function validate(json: unknown): ValidateResult$1;
/**
 * Evaluate a tool call against a canonical policy.
 *
 * @param tool - Tool name (e.g. "Bash", "Read").
 * @param input - Tool input string to match against patterns.
 * @param json - Parsed canonical policy JSON.
 * @param context - Optional evaluation context (cwd, branch).
 * @returns Check result with the evaluation decision.
 * @throws Error if the policy is invalid.
 */
declare function check(tool: string, input: string, json: unknown, context?: {
  cwd?: string;
  branch?: string;
}): CheckResult;
/** Error thrown when conversion or validation fails. */
declare class ConvertError extends Error {
  /** Validation errors that caused the failure. */
  readonly errors: ValidationError[];
  constructor(message: string, errors: ValidationError[]);
}
//#endregion
//#region src/agent-files.d.ts
/** Per-format config file info. */
interface AgentFileDef {
  /** Relative path to the main config file. */
  name: string;
  /** Relative path to the local override file (read-only, never written). */
  localName?: string;
  /**
   * Extract the permissions payload from a parsed native config.
   * Returns undefined if the config doesn't contain a permissions block.
   */
  extract?: (raw: unknown) => unknown;
  /**
   * Wrap encoded permissions back into the native config structure.
   */
  wrap?: (encoded: unknown) => unknown;
}
/** Default config file for each agent format, relative to a project root. */
declare const AGENT_FILES: Record<AgentId | "canonical", AgentFileDef>;
/** Get the default file name for a format. */
declare function defaultFileName(format: Format): string;
/**
 * Walk up from a starting directory, looking for a format's default file.
 * Returns the first existing file found, or the default path in `startDir`.
 */
declare function findDefaultFile(format: Format, startDir: string): string;
/** Discriminated union for operations that can fail. */
type Result<T> = {
  ok: true;
  value: T;
} | {
  ok: false;
  error: string;
};
/** Create a successful result. */
declare function ok<T>(value: T): Result<T>;
/** Create a failed result. */
declare function fail<T>(error: string): Result<T>;
/** Read stdin as a string. */
declare function readStdin(): Promise<string>;
/** Read from a file path, or stdin if undefined. */
declare function readInput(path: string | undefined): Promise<string>;
/** Parse a JSON string. Returns a Result instead of throwing. */
declare function parseJson(raw: string, source: string): Result<unknown>;
/** Write JSON to a file, creating parent directories as needed. */
declare function writeJsonFile(path: string, content: string): Promise<void>;
/** Validation error for a single field. */
interface ValidationError {
  /** Dot-separated path to the invalid field, or "(root)". */
  path: string;
  /** Human-readable error message. */
  message: string;
}
/** Detailed validation result with structured errors. */
type ValidateResult = {
  ok: true;
  value: AgentPermissionPolicy;
} | {
  ok: false;
  error: string;
  errors: ValidationError[];
};
/** Validate parsed JSON against the canonical policy schema. */
declare function validatePolicy(json: unknown): ValidateResult;
/**
 * Decode native agent config → canonical policy.
 * Extracts the permissions payload using the agent's extract(),
 * decodes via codec, then validates against the canonical schema.
 */
declare function decodeNative(format: AgentId, raw: unknown): ValidateResult;
//#endregion
export { detectFormat as C, validate as E, convert as S, resolveFormat as T, ConvertError as _, ValidationError as a, ValidateResult$1 as b, fail as c, parseJson as d, readInput as f, CheckResult as g, writeJsonFile as h, ValidateResult as i, findDefaultFile as l, validatePolicy as m, AgentFileDef as n, decodeNative as o, readStdin as p, Result as r, defaultFileName as s, AGENT_FILES as t, ok as u, ConvertResult as v, detectFormatFromPath as w, check as x, Format as y };
//# sourceMappingURL=agent-files-Br28MM87.d.mts.map