export interface ProviderSandboxConfig {
    /** Container image that includes the provider CLI. */
    image: string;
    /** Command to run inside the container (defaults to provider.command). */
    command?: string;
}
export interface ProviderConfig {
    command: string;
    /**
     * Idle timeout in seconds. The runner kills the provider process if no
     * stdout/stderr chunk has been received for this many seconds. Defaults to
     * 180 when neither agent nor provider sets a value.
     */
    timeout_seconds?: number;
    /**
     * Grace window in seconds between SIGTERM and SIGKILL when the idle timeout
     * fires. Defaults to 5.
     */
    kill_grace_seconds?: number;
    /** Sandbox runtime config for container-based execution. */
    sandbox?: ProviderSandboxConfig;
}
export type UserRole = string;
export type TeepeeMode = 'private' | 'shared';
export type AgentAccessProfile = 'readonly' | 'draft' | 'readwrite' | 'trusted';
/** @deprecated Use AgentAccessProfile. */
export type AgentProfile = AgentAccessProfile;
export type ChainPolicy = 'none' | 'propose_only' | 'delegate_with_origin_policy';
export interface AgentConfig {
    provider: string;
    prompt?: string;
    timeout_seconds?: number;
    chain_policy?: ChainPolicy;
}
export type ExecutionMode = 'host' | 'sandbox' | 'db_only' | 'disabled';
export interface SecurityConfig {
    sandbox: {
        runner: 'bubblewrap' | 'container';
        empty_home: boolean;
        private_tmp: boolean;
        forward_env: string[];
        /** Container image for macOS/container sandbox backend. */
        container_image?: string;
    };
}
export interface LimitsConfig {
    max_agents_per_message: number;
    max_jobs_per_user_per_minute: number;
    max_chain_depth: number;
    max_total_jobs_per_chain: number;
}
export declare const CAPABILITIES: readonly ["files.workspace.access", "files.host.access", "admin.view", "users.list", "users.invite", "users.revoke", "users.reenable", "users.delete", "users.role.set", "users.owner.promote", "users.owner.demote", "topics.create", "topics.rename", "topics.archive", "topics.restore", "topics.move", "topics.language.set", "topics.alias.set", "messages.post", "artifacts.promote", "input_requests.cancel.any"];
export type Capability = typeof CAPABILITIES[number];
export type FilesystemRootKind = 'workspace' | 'host';
export interface FilesystemRootConfig {
    id: string;
    kind: FilesystemRootKind;
    path: string;
    resolvedPath: string;
}
export interface FilesystemConfig {
    /**
     * When false (the default), the implicit `host` root (kind: 'host', path: '/')
     * is not registered, even for the owner. Set to true in `.teepee/config.yaml`
     * under `filesystem.allow_host_root` to opt in.
     */
    allow_host_root: boolean;
    roots: FilesystemRootConfig[];
}
export interface BaseRoleConfig {
    agents: Record<string, AgentAccessProfile>;
}
export interface OwnerRoleConfig extends BaseRoleConfig {
    superuser: true;
    capabilities?: never;
}
export interface NonOwnerRoleConfig extends BaseRoleConfig {
    capabilities: Capability[];
    superuser?: false;
}
export type RoleConfig = OwnerRoleConfig | NonOwnerRoleConfig;
export type RoleConfigMap = Record<string, RoleConfig>;
export interface TeepeeConfig {
    version: 1 | 2;
    mode: TeepeeMode;
    teepee: {
        name: string;
        language: string;
        demo: {
            enabled: boolean;
            topic_name: string;
            hotkey: string;
            delay_ms: number;
        };
    };
    server: {
        trust_proxy: boolean;
        cors_allowed_origins: string[];
        auth_rate_limit_window_seconds: number;
        auth_rate_limit_max_requests: number;
    };
    providers: Record<string, ProviderConfig>;
    agents: Record<string, AgentConfig>;
    roles: RoleConfigMap;
    filesystem: FilesystemConfig;
    limits: LimitsConfig;
    security: SecurityConfig;
}
export interface ConfigMigrationOptions {
    write?: boolean;
    backupPath?: string;
}
export interface ConfigMigrationResult {
    migrated: boolean;
    output: string;
    sourceVersion: 1 | 2;
    backupPath?: string;
}
export declare function loadConfig(configPath: string): TeepeeConfig;
export declare function migrateConfigFileToV2(configPath: string, options?: ConfigMigrationOptions): ConfigMigrationResult;
export declare function resolvePrompt(agentName: string, agentConfig: AgentConfig, basePath: string): string;
/** Default idle timeout in seconds when neither agent nor provider overrides it. */
export declare const DEFAULT_TIMEOUT_SECONDS = 180;
/** Default SIGTERM→SIGKILL grace window in seconds when a provider is killed on idle timeout. */
export declare const DEFAULT_KILL_GRACE_SECONDS = 5;
/**
 * Resolve the idle timeout (in milliseconds) for an agent, with the
 * agent → provider → default fallback chain.
 *
 * An explicit value of `0` at any level means "disable idle-timeout
 * enforcement for this agent" and short-circuits the chain. Only a
 * genuinely missing (`undefined`) value is treated as "not set".
 */
export declare function resolveTimeout(agentName: string, config: TeepeeConfig): number;
/**
 * Resolve the SIGTERM→SIGKILL grace window (in milliseconds) for an agent.
 * An explicit `0` means "send SIGKILL immediately"; only `undefined`
 * triggers the default.
 */
export declare function resolveKillGrace(agentName: string, config: TeepeeConfig): number;
export declare function isOwnerRole(role: string): boolean;
export declare function normalizeConfiguredRole(role: string): string;
export declare function getRoleConfig(config: TeepeeConfig, role: string): RoleConfig | null;
export declare function hasRole(config: TeepeeConfig, role: string): boolean;
export declare function listRoleIds(config: TeepeeConfig): string[];
export declare function listAssignableRoleIds(config: TeepeeConfig): string[];
export declare function getFilesystemRoot(config: TeepeeConfig, rootId: string): FilesystemRootConfig | null;
export declare function listFilesystemRoots(config: TeepeeConfig): FilesystemRootConfig[];
export declare function requiredCapabilityForFilesystemRoot(root: Pick<FilesystemRootConfig, 'kind'>): Capability;
export declare function listAccessibleFilesystemRoots(config: TeepeeConfig, role: string): FilesystemRootConfig[];
export declare function listRoleCapabilities(config: TeepeeConfig, role: string): Capability[];
export declare function hasCapability(config: TeepeeConfig, role: string, capability: Capability): boolean;
export declare function resolveRoleAgentProfile(config: TeepeeConfig, role: string, agentName: string): AgentAccessProfile | null;
//# sourceMappingURL=config.d.ts.map