import type { CodeEnvironmentPermissionDecision, CodeEnvironmentUserConfigSchema, CodeEnvironmentUserSettings } from '../config';
export declare const CODE_APPROVAL_MODES: readonly ["ask", "acceptEdits", "fullAccess"];
export type CodeApprovalMode = (typeof CODE_APPROVAL_MODES)[number];
type CodePermissions = Required<NonNullable<CodeEnvironmentUserSettings['permissions']>>;
export type CodeApprovalConstraints = {
    environment: 'attached' | 'managed';
    enabled?: boolean;
    allowedModes?: readonly CodeApprovalMode[];
    configSchema?: CodeEnvironmentUserConfigSchema;
    settings?: CodeEnvironmentUserSettings;
};
/** Omitted deployment configuration never grants unattended execution. */
export declare function getAllowedCodeApprovalModes({ enabled, allowedModes, configSchema, settings, environment, }: CodeApprovalConstraints): CodeApprovalMode[];
export declare class CodeApprovalModeError extends Error {
    readonly code = "CODE_APPROVAL_MODE_NOT_ALLOWED";
    constructor();
}
/** Validate untrusted request state again at admission, including after policy changes. */
export declare function resolveCodeApprovalMode(requested: unknown, constraints: CodeApprovalConstraints): CodeApprovalMode | undefined;
/** Apply a turn preference without modifying machine settings or overriding an existing deny. */
export declare function resolveCodePermissionDecision({ mode, category, decision, }: {
    mode?: CodeApprovalMode;
    category: keyof CodePermissions;
    decision: CodeEnvironmentPermissionDecision;
}): CodeEnvironmentPermissionDecision;
export {};