export declare const MANAGED_HOOK_EVENTS: readonly ["SessionStart", "PreToolUse", "PostToolUse", "UserPromptSubmit", "PreCompact", "PostCompact", "Stop"];
type ManagedHookEventName = (typeof MANAGED_HOOK_EVENTS)[number];
export interface JsonObject {
    [key: string]: JsonValue;
}
export interface JsonArray extends Array<JsonValue> {
}
export type JsonValue = JsonObject | JsonArray | string | number | boolean | null;
export interface ManagedHookEntry {
    matcher?: string;
    hooks: Array<{
        type: "command";
        command: string;
        statusMessage?: string;
        timeout?: number;
    }>;
}
export interface ManagedCodexHooksConfig {
    hooks: Record<ManagedHookEventName, ManagedHookEntry[]>;
}
interface ParsedCodexHooksConfig {
    root: JsonObject;
    hooks: JsonObject;
}
export interface RemoveManagedCodexHooksResult {
    nextContent: string | null;
    removedCount: number;
}
export interface ManagedCodexHookTrustState {
    trusted_hash: string;
}
export interface CodexHooksJsonTrustStateEntry {
    trusted_hash: string;
    enabled?: boolean;
}
export interface DedupedCodexHookConfigPath {
    path: string;
    reason: "unique";
}
export interface SkippedCodexHookConfigPath {
    path: string;
    reason: "runtime_codex_home_mirror" | "duplicate_realpath";
    canonicalPath?: string;
}
export interface DiscoverCodexHookConfigPathsOptions {
    maxFiles?: number;
}
type HookCommandPlatform = NodeJS.Platform;
export declare function escapeTomlBasicString(value: string): string;
export declare const WINDOWS_NATIVE_HOOK_SHIM_RELATIVE_PATH: readonly ["hooks", "omx-native-hook-windows-shim.ps1"];
export interface ManagedCodexHookOptions {
    platform?: HookCommandPlatform;
    codexHomeDir?: string;
    nodePath?: string;
    hookScriptPath?: string;
    env?: NodeJS.ProcessEnv;
    /**
     * Final hooks.json content to derive Codex hook trust keys from. Omit it to
     * retain the historical canonical-builder fallback; null declares no final artifact.
     */
    hooksContent?: string | null;
}
/**
 * Resolve an absolute path to Windows PowerShell. When PATH has been shortened
 * (e.g. by a runtime shim that dropped System32), a bare `powershell.exe` fails
 * to resolve, so prefer SystemRoot/windir and fall back to the well-known
 * default install location.
 */
export declare function resolveWindowsPowerShellPath(env?: NodeJS.ProcessEnv): string;
export declare function buildManagedCodexNativeHookWindowsShimPath(codexHomeDir: string): string;
export type ManagedCodexNativeHookWindowsShimOwnership = "current" | "historical" | "modified";
/**
 * Classify a Windows native-hook shim from its raw on-disk bytes. Current
 * shims must be byte-identical to `expected`; historical shims must be the
 * complete, BOM-prefixed generated forwarding template with independently
 * proof-valid variable paths. Every other input is modified.
 */
export declare function classifyManagedCodexNativeHookWindowsShimOwnership(content: Buffer, expected: Buffer): ManagedCodexNativeHookWindowsShimOwnership;
export declare function buildManagedCodexNativeHookWindowsShimContent(pkgRoot: string, options?: Pick<ManagedCodexHookOptions, "hookScriptPath" | "nodePath">): string;
export declare function buildManagedCodexNativeHookCommand(pkgRoot: string, optionsOrPlatform?: HookCommandPlatform | ManagedCodexHookOptions): string;
export declare function buildManagedCodexHooksConfig(pkgRoot: string, options?: ManagedCodexHookOptions): ManagedCodexHooksConfig;
export interface SourceSpan {
    start: number;
    end: number;
}
declare const CODEX_HOOK_EVENTS: readonly ["PreToolUse", "PermissionRequest", "PostToolUse", "PreCompact", "PostCompact", "SessionStart", "UserPromptSubmit", "SubagentStart", "SubagentStop", "Stop"];
type CodexHookEventName = (typeof CODEX_HOOK_EVENTS)[number];
export type ManagedCodexHooksPlanErrorCode = "invalid_document" | "ambiguous_managed_handler" | "ambiguous_managed_group" | "unsafe_managed_removal" | "managed_trust_key_conflict";
export declare class ManagedCodexHooksPlanError extends Error {
    readonly code: ManagedCodexHooksPlanErrorCode;
    readonly details: Readonly<Record<string, unknown>>;
    constructor(code: ManagedCodexHooksPlanErrorCode, message: string, details?: Record<string, unknown>);
}
export interface CodexHooksDiagnostic {
    code: "invalid_matcher" | "async_command" | "empty_command" | "unsupported_handler";
    eventName: CodexHookEventName;
    groupIndex: number;
    handlerIndex?: number;
    message: string;
}
/** Backwards-compatible singular spelling. */
export type CodexHookDiagnostic = CodexHooksDiagnostic;
export interface CodexHookGroupOccurrence {
    eventName: CodexHookEventName;
    groupIndex: number;
    span: SourceSpan;
}
export interface CodexHookHandlerOccurrence {
    eventName: CodexHookEventName;
    groupIndex: number;
    handlerIndex: number;
    span: SourceSpan;
}
export interface CodexHookDiscoveryCommand {
    eventName: CodexHookEventName;
    groupIndex: number;
    handlerIndex: number;
    command: string;
}
export interface ValidCodexHooksConfigStrict {
    ok: true;
    root: JsonObject;
    diagnostics: CodexHooksDiagnostic[];
    groupOccurrences: CodexHookGroupOccurrence[];
    handlerOccurrences: CodexHookHandlerOccurrence[];
    discoveredCommands: CodexHookDiscoveryCommand[];
}
export interface InvalidCodexHooksConfigStrict {
    ok: false;
    error: ManagedCodexHooksPlanError;
}
export type CodexHooksConfigStrictResult = ValidCodexHooksConfigStrict | InvalidCodexHooksConfigStrict;
export interface ManagedCodexHooksCoordinateProof {
    safe: boolean;
    shifted?: {
        kind: "group" | "handler";
        eventName: CodexHookEventName;
        oldCoordinate: readonly number[];
        newCoordinate?: readonly number[];
    };
}
export interface ManagedCodexHooksPlan {
    ok: true;
    finalContent: string | null;
    changed: boolean;
    removedCount: number;
    finalTrustState: Record<string, ManagedCodexHookTrustState>;
    hasForeignHooks: boolean;
    coordinateProof: ManagedCodexHooksCoordinateProof;
    priorTrustState: Record<string, ManagedCodexHookTrustState>;
    diagnostics: CodexHooksDiagnostic[];
    legacyTrustState: Record<string, CodexHooksJsonTrustStateEntry>;
}
export interface FailedManagedCodexHooksPlan {
    ok: false;
    error: ManagedCodexHooksPlanError;
    diagnostics: CodexHooksDiagnostic[];
}
export type ManagedCodexHooksPlanResult = ManagedCodexHooksPlan | FailedManagedCodexHooksPlan;
export interface ManagedCodexHookTrustScan {
    ok: true;
    trustState: Record<string, ManagedCodexHookTrustState>;
    groupOccurrences: CodexHookGroupOccurrence[];
    handlerOccurrences: CodexHookHandlerOccurrence[];
}
export type ManagedCodexHookTrustScanResult = ManagedCodexHookTrustScan | InvalidCodexHooksConfigStrict;
export declare function validateCodexHooksConfigStrict(content: string, options?: ManagedCodexHookOptions): CodexHooksConfigStrictResult;
/** Compatibility-only permissive JSON intake; strict plans never use this parser. */
export declare function parseCodexHooksConfig(content: string): ParsedCodexHooksConfig | null;
/**
 * Parse an OMX Windows shim invocation using the managed-command ownership
 * grammar. Returns the validated shim path; returns null for every other
 * command. Supplying current install options additionally recognizes the exact
 * non-Windows host-path spelling used by platform-seam validation.
 */
export declare function parseManagedCodexNativeHookWindowsShimCommand(command: string, options?: ManagedCodexHookOptions): string | null;
/**
 * Returns whether a command has the exact approved token grammar of an OMX
 * native hook from this or a historical installation. Ownership requires a
 * shell-static executable and provenance-qualified terminal script path, but
 * never a current package-root path. The union is deliberately narrow and
 * accepts only shell-static POSIX, Windows, or PowerShell command spellings.
 */
export declare function isManagedCodexHookCommand(command: string): boolean;
export declare function scanManagedCodexHookTrustStateFromContent(content: string, hooksPath: string, options?: ManagedCodexHookOptions): ManagedCodexHookTrustScanResult;
export declare function planManagedCodexHooksMerge(existingContent: string | null | undefined, pkgRoot: string, hooksPath: string, options?: ManagedCodexHookOptions): ManagedCodexHooksPlanResult;
export declare function planManagedCodexHooksRemoval(existingContent: string, hooksPath: string, options?: ManagedCodexHookOptions): ManagedCodexHooksPlanResult;
export declare function getMissingManagedCodexHookEvents(content: string): ManagedHookEventName[] | null;
export declare function getManagedCodexHookCommandsForEvent(content: string, eventName: ManagedHookEventName): string[] | null;
export declare function buildManagedCodexHookTrustState(hooksPath: string, pkgRoot: string, options?: ManagedCodexHookOptions): Record<string, ManagedCodexHookTrustState>;
export declare function buildManagedCodexHookTrustToml(hooksPath: string | undefined, pkgRoot: string, options?: ManagedCodexHookOptions): string;
export declare function isRuntimeCodexHomeMirrorPath(hookConfigPath: string, cwd?: string): boolean;
export declare function dedupeCodexHookConfigPaths(hookConfigPaths: readonly string[], cwd?: string): Promise<{
    paths: DedupedCodexHookConfigPath[];
    skipped: SkippedCodexHookConfigPath[];
}>;
export declare function discoverCodexHookConfigPaths(cwd?: string, options?: DiscoverCodexHookConfigPathsOptions): Promise<{
    paths: DedupedCodexHookConfigPath[];
    skipped: SkippedCodexHookConfigPath[];
}>;
export declare function extractCodexHooksJsonTrustState(content: string | null | undefined): Record<string, CodexHooksJsonTrustStateEntry>;
export declare function hasCodexHooksJsonTopLevelState(content: string): boolean | null;
export declare function mergeManagedCodexHooksConfig(existingContent: string | null | undefined, pkgRoot: string, hooksPathOrOptions?: string | ManagedCodexHookOptions, options?: ManagedCodexHookOptions): string;
export declare function removeManagedCodexHooks(existingContent: string): RemoveManagedCodexHooksResult;
export declare function hasCodexHookEntries(content: string): boolean;
export declare function hasUserCodexHooksAfterManagedRemoval(existingContent: string): boolean;
export {};
//# sourceMappingURL=codex-hooks.d.ts.map