import { c as Rule } from "./schema-8GX5HdGH.cjs";

//#region src/evaluate.d.ts
type PermissionDecision = "deny" | "ask" | "allow";
type PermissionTier = "deny" | "ask" | "allow";
interface PermissionPolicy {
  defaultMode: "autonomous" | "standard" | "restricted" | "readonly";
  rules?: Rule[];
}
/** Context for conditional rule evaluation (cwd, branch, etc.). */
interface EvaluationContext {
  cwd?: string;
  branch?: string;
}
/**
 * Normalise a string rule from `permissions.allow/deny/ask` into a structured Rule.
 *
 * String rule syntax:
 *   - `"Read"` → `{ tool: "Read", tier }`
 *   - `"Bash(git status)"` → `{ tool: "Bash", pattern: "git status", tier }`
 *   - `"Bash(npm:*)"` → `{ tool: "Bash", pattern: "npm:*", tier }`
 *   - `"Bash()"` → `{ tool: "Bash", tier }` (match all)
 *   - `"mcp__github__*"` → `{ tool: "mcp__github__*", tier }`
 */
declare function normaliseStringRule(rule: string, tier: PermissionTier): Rule;
/**
 * Evaluate a tool call against the permission policy.
 *
 * Order: deny rules → ask rules → allow rules → defaultMode
 */
declare function evaluate(policy: PermissionPolicy, toolName: string, input: string, ctx?: EvaluationContext): PermissionDecision;
/**
 * Convert a structured Rule back to a string rule (e.g. `"Bash(npm:*)"`).
 *
 * Returns just the tool name for bare rules (no pattern).
 */
declare function ruleToString(rule: Rule): string;
/**
 * Collect all rules from a canonical policy, normalising both
 * `rules[]` and `permissions.allow/deny/ask` into a single array.
 */
declare function collectRules(policy: {
  rules?: Rule[] | undefined;
  permissions?: {
    allow?: string[] | undefined;
    deny?: string[] | undefined;
    ask?: string[] | undefined;
  } | undefined;
}): Rule[];
/**
 * Map a schema-mode string to a normalised evaluation mode.
 *
 * Agent-specific names (bypassPermissions, dontAsk, plan) are
 * mapped to their canonical equivalents.
 */
declare function mapMode(mode: string): PermissionPolicy["defaultMode"];
/**
 * Compare two mode strings by restrictiveness.
 * Returns the more restrictive of the two.
 */
declare function mostRestrictiveMode(a: string | undefined, b: string | undefined): string | undefined;
/**
 * Rule identity key for deduplication (tool + pattern, excluding tier).
 */
declare function ruleKey(rule: Rule): string;
/**
 * Deduplicate rules by tool+pattern, keeping the highest-priority tier.
 * Deny beats ask beats allow for the same tool+pattern combination.
 */
declare function deduplicateRules(rules: Rule[]): Rule[];
//#endregion
export { EvaluationContext, PermissionDecision, PermissionPolicy, PermissionTier, collectRules, deduplicateRules, evaluate, mapMode, mostRestrictiveMode, normaliseStringRule, ruleKey, ruleToString };
//# sourceMappingURL=evaluate.d.cts.map