import { t as AgentPermissionPolicy } from "./schema-BXTTXvJl.mjs";
import { AgentId, OmpEncoded } from "./compat/codecs.mjs";
import { i as EvaluationContext, r as DecisionStep } from "./evaluate-DXlKxvts.mjs";
import { i as Suggestion, n as ReplayReport } from "./replay-BuTXKQ5p.mjs";
//#region src/api.d.ts
/** Supported format identifiers, including canonical. */
type Format = AgentId | "canonical";
/** Result of a successful conversion. */
interface ConvertResult {
  /** The converted output (agent-native JSON object). */
  output: unknown;
  /** The format that was decoded from (auto-detected or explicit). */
  from: Format;
  /** Number of rules in the intermediate canonical representation. */
  ruleCount: number;
  /** Further files the target needs beside its config, such as Codex's execpolicy rules file. */
  companions: CompanionFile[];
}
/** A file written beside a converted config. */
interface CompanionFile {
  /** Path relative to the directory holding the converted config. */
  path: string;
  content: string;
}
/** Result of validating a policy. */
interface ValidateResult$1 {
  /** Whether the policy is valid. */
  valid: boolean;
  /** Validation errors (empty when valid). */
  errors: ValidationError[];
}
/** The facts about the call that a rule's `when` conditions are checked against. */
type CheckContext = EvaluationContext;
/** Result of checking a tool call against a policy. */
interface CheckResult {
  /** The evaluation decision. */
  decision: "allow" | "deny" | "ask";
  /** How each command was judged: the matching rule, or the default mode. */
  steps: DecisionStep[];
  /** Whether a `hidden` deny rule matched, so the host should leave the tool out of its list. */
  hidden: boolean;
}
/**
 * Detect the agent format from a file path.
 *
 * Matches against known config file names:
 *
 * - `.claude/settings.json` or `.claude/settings.local.json` → claude-code
 * - `opencode.json` → opencode
 * - `.kiro/permissions.json` → kiro
 * - `codex.toml` → codex
 * - `.omp/config.yml` (a project's) or `.omp/agent/config.yml` (the global one) → omp
 * - `.agents/permissions.json` or `.agents/permissions.local.json` → canonical
 */
declare function detectFormatFromPath(filePath: string): Format | undefined;
/**
 * Resolve a format specifier that may be an agent name or a file path.
 *
 * Returns the format if it's a known agent name. Returns the detected format if it's a known config
 * file path. Returns undefined if neither.
 */
declare function resolveFormat(spec: string): Format | undefined;
/**
 * Detect the agent format from parsed JSON content.
 *
 * Distinguishing features: canonical — `rules` array of {tool, tier} objects, or top-level
 * `permissions`, `sandbox`, `profiles`, etc. claude-code — `allow`/`deny`/`ask` arrays of plain
 * strings, `additionalDirectories` crush — `allowed_tools` (required) array of plain strings kiro —
 * `allowedTools` or `toolsSettings` codex — `approval_policy`, `sandbox_mode`, `permissions`
 * (record of named profiles) opencode — bare "allow"/"deny" string, or object with lowercase tool
 * keys (bash, read, edit, …)
 */
declare function detectFormat(value: unknown): Format | undefined;
/**
 * Convert a permission config between agent formats.
 *
 * @param from - Source format. Omit or `undefined` to auto-detect.
 * @param to - Target format (required).
 * @param json - Parsed JSON input (any agent-native or canonical object).
 *
 * @returns Conversion result with output, detected format, and rule count.
 *
 * @throws Error on invalid input, unknown format, or codec failure.
 */
declare function convert(from: Format | undefined, to: Format, json: unknown): ConvertResult;
/**
 * Validate a parsed JSON object against the canonical policy schema.
 *
 * @param json - Parsed JSON to validate.
 *
 * @returns Validation result with errors array (empty when valid).
 */
declare function validate(json: unknown): ValidateResult$1;
/**
 * Evaluate a tool call against a canonical policy.
 *
 * @param tool - Tool name (e.g. "Bash", "Read").
 * @param input - Tool input string to match against patterns.
 * @param json - Parsed canonical policy JSON.
 * @param context - Optional evaluation context (cwd, branch, remote, env, depth).
 *
 * @returns Check result with the evaluation decision.
 *
 * @throws Error if the policy is invalid.
 */
declare function check(tool: string, input: string, json: unknown, context?: CheckContext): CheckResult;
/**
 * Replay a policy over a recorded session transcript.
 *
 * @param json - Parsed canonical policy JSON.
 * @param transcript - The transcript's JSON Lines text (see `agent-perms/replay` for the fields read).
 *
 * @returns How many calls the policy would allow, ask about and deny, and the calls whose recorded outcome it could not have produced.
 *
 * @throws {ConvertError} If the policy is invalid.
 * @throws {SyntaxError} If a transcript line is not JSON.
 */
declare function replay(json: unknown, transcript: string): ReplayReport;
/** Options for {@link suggest}. */
interface SuggestOptions {
  /** How many approved calls a rule must cover to be proposed. */
  minCount: number;
  /** Parsed canonical policy JSON whose deny rules exclude commands and whose allow rules make a proposal unnecessary. */
  policy?: unknown;
}
/**
 * Propose allow rules for calls a recorded session shows were approved repeatedly.
 *
 * @param transcript - The transcript's JSON Lines text (see `agent-perms/replay` for the fields read).
 *
 * @returns The proposed rules, each with how many approved calls it covers.
 *
 * @throws {ConvertError} If the policy is invalid.
 * @throws {SyntaxError} If a transcript line is not JSON.
 */
declare function suggest(transcript: string, options: SuggestOptions): Suggestion[];
/** Error thrown when conversion or validation fails. */
declare class ConvertError extends Error {
  /** Validation errors that caused the failure. */
  readonly errors: ValidationError[];
  constructor(message: string, errors: ValidationError[]);
}
//#endregion
//#region src/agent-files.d.ts
/** Per-format config file info. */
interface AgentFileDef {
  /** Relative path to the main config file. */
  name: string;
  /** Relative path to the local override file (read-only, never written). */
  localName?: string;
  /**
   * Extract the permissions payload from a parsed native config. Returns undefined if the config
   * doesn't contain a permissions block.
   */
  extract?: (raw: unknown) => unknown;
  /** Wrap encoded permissions back into the native config structure. */
  wrap?: (encoded: unknown) => unknown;
}
/** Default config file for each agent format, relative to a project root. */
declare const AGENT_FILES: Record<AgentId | "canonical", AgentFileDef>;
/** Get the default file name for a format. */
declare function defaultFileName(format: Format): string;
/**
 * Walk up from a starting directory, looking for a format's default file. Returns the first
 * existing file found, or the default path in `startDir`.
 */
declare function findDefaultFile(format: Format, startDir: string): string;
/** Discriminated union for operations that can fail. */
type Result<T> = {
  ok: true;
  value: T;
} | {
  ok: false;
  error: string;
};
/** Create a successful result. */
declare function ok<T>(value: T): Result<T>;
/** Create a failed result. */
declare function fail<T>(error: string): Result<T>;
/** Read stdin as a string. */
declare function readStdin(): Promise<string>;
/** Read from a file path, or stdin if undefined. */
declare function readInput(path: string | undefined): Promise<string>;
/** Parse a JSON string. Returns a Result instead of throwing. */
declare function parseJson(raw: string, source: string): Result<unknown>;
/**
 * Parse an agent's native config. OMP's is YAML; every other agent's is JSON. YAML is a superset of
 * JSON, so an OMP config written as JSON parses too.
 */
declare function parseAgentFile(format: Format | undefined, raw: string, source: string): Result<unknown>;
/** A native config as file content: YAML for OMP, JSON for everything else. */
declare function stringifyAgentFile(format: Format, value: unknown, compact: boolean): string;
/**
 * OMP's agent directory, which holds its global config: `PI_CODING_AGENT_DIR` when set, as OMP
 * reads it, else `~/.omp/agent`.
 */
declare function ompAgentDir(env: Readonly<Record<string, string | undefined>>, home: string): string;
/** OMP's agent directory for this process. */
declare function defaultOmpAgentDir(): string;
/**
 * OMP's global config in an agent directory, chosen as OMP chooses it: the first of `config.yml`
 * and `config.yaml` that exists, else `config.yml`.
 */
declare function ompGlobalConfigPath(agentDir: string): string;
/**
 * An OMP config with `bash.patterns` and `tools.approvalMode` set from an encoded policy and
 * everything else, comments included, left as it was. `bash.patterns` is replaced by the encoded
 * list, or removed when there is none; `tools.approvalMode` is set only when the encoding has one,
 * so a mode the policy leaves to OMP stays as the user wrote it.
 *
 * @param current The file's content, or `null` for a new file.
 * @throws Error when `current` is not valid YAML or its top level is not a mapping, rather than
 *   replacing a file it could not read.
 */
declare function editOmpConfig(current: string | null, encoded: OmpEncoded): string;
/** Write JSON to a file, creating parent directories as needed. */
declare function writeJsonFile(path: string, content: string): Promise<void>;
/** Validation error for a single field. */
interface ValidationError {
  /** Dot-separated path to the invalid field, or "(root)". */
  path: string;
  /** Human-readable error message. */
  message: string;
}
/** Detailed validation result with structured errors. */
type ValidateResult = {
  ok: true;
  value: AgentPermissionPolicy;
} | {
  ok: false;
  error: string;
  errors: ValidationError[];
};
/** Validate parsed JSON against the canonical policy schema. */
declare function validatePolicy(json: unknown): ValidateResult;
/**
 * Decode native agent config → canonical policy. Extracts the permissions payload using the agent's
 * extract(), decodes via codec, then validates against the canonical schema.
 */
declare function decodeNative(format: AgentId, raw: unknown): ValidateResult;
//#endregion
export { check as A, CheckResult as C, Format as D, ConvertResult as E, resolveFormat as F, suggest as I, validate as L, detectFormat as M, detectFormatFromPath as N, SuggestOptions as O, replay as P, CheckContext as S, ConvertError as T, readInput as _, ValidationError as a, validatePolicy as b, defaultOmpAgentDir as c, findDefaultFile as d, ok as f, parseJson as g, parseAgentFile as h, ValidateResult as i, convert as j, ValidateResult$1 as k, editOmpConfig as l, ompGlobalConfigPath as m, AgentFileDef as n, decodeNative as o, ompAgentDir as p, Result as r, defaultFileName as s, AGENT_FILES as t, fail as u, readStdin as v, CompanionFile as w, writeJsonFile as x, stringifyAgentFile as y };
//# sourceMappingURL=agent-files-BCoTY9VL.d.mts.map