import { z } from "zod";
/**
 * What a guard is, declared once and used by both things that can declare one:
 * a plugin manifest and a project's `ue-mcp.yml`.
 *
 * A guard used to be a task whose NAME encoded everything: `guard.sandbox.
 * beforeWrite` meant a guard called sandbox, running before the call, applying
 * only to writes. That encoding could not express anything else, so ordering
 * was unreachable, a guard wanting both hooks had to be two tasks that did not
 * know they were related, and a misspelling produced an ordinary task nobody
 * ever called rather than an error.
 *
 * The four "phases" were also never four things. They are two hooks and two
 * scopes, so they are two fields.
 */
/**
 * Which calls a guard sees.
 *
 *   all        every call, including reads. For audit and rate limiting.
 *   mutations  every call that changes editor state, whether or not it names
 *              an asset. This is what "block everything that mutates" means:
 *              spawning an actor and starting a play session are in, reads are
 *              out. Includes `unknown`, which is gated as a change everywhere.
 *   writes     calls that modify content already on disk. Narrower than
 *              mutations on purpose: it is the source-control question, and a
 *              call that creates something new modifies nothing yet.
 *   reads      only the calls that observe. For auditing what an agent looked
 *              at without the noise of everything it did.
 *   unknown    only the calls whose effect a PARAMETER decides: an arbitrary
 *              python string, a console command, a wrapped Epic tool, a
 *              reflected function invocation. The escape hatches, and the
 *              narrowest useful scope for "make somebody approve this".
 *
 * Every one of them is answered from what the action DECLARED. Until that
 * existed, `reads` and `unknown` could not be offered at all: the answer came
 * from matching the call's name against a list of verbs, which can approximate
 * "not a read" and cannot pick out the set whose effect is genuinely unknowable
 * from the name.
 */
export declare const GuardScopeSchema: z.ZodDefault<z.ZodEnum<["all", "mutations", "writes", "reads", "unknown"]>>;
/** One hook: the task to run, and the options it is built with. */
export declare const GuardHookSchema: z.ZodObject<{
    class_path: z.ZodString;
    options: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    options: Record<string, unknown>;
    class_path: string;
}, {
    class_path: string;
    options?: Record<string, unknown> | undefined;
}>;
export declare const GuardDeclarationSchema: z.ZodEffects<z.ZodObject<{
    description: z.ZodOptional<z.ZodString>;
    /**
     * `writes` costs nothing on a read: the pipeline only resolves which files
     * a call touches when a guard asks for it.
     */
    scope: z.ZodDefault<z.ZodEnum<["all", "mutations", "writes", "reads", "unknown"]>>;
    /** Lower runs first before the call, and last after it. */
    order: z.ZodDefault<z.ZodNumber>;
    /** Runs before the call. Denying here means the call never happens. */
    before: z.ZodOptional<z.ZodObject<{
        class_path: z.ZodString;
        options: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        options: Record<string, unknown>;
        class_path: string;
    }, {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    }>>;
    /** Runs after a successful call, and may replace its result. */
    after: z.ZodOptional<z.ZodObject<{
        class_path: z.ZodString;
        options: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        options: Record<string, unknown>;
        class_path: string;
    }, {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    }>>;
}, "strip", z.ZodTypeAny, {
    order: number;
    scope: "unknown" | "all" | "mutations" | "writes" | "reads";
    description?: string | undefined;
    before?: {
        options: Record<string, unknown>;
        class_path: string;
    } | undefined;
    after?: {
        options: Record<string, unknown>;
        class_path: string;
    } | undefined;
}, {
    order?: number | undefined;
    description?: string | undefined;
    before?: {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    } | undefined;
    after?: {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    } | undefined;
    scope?: "unknown" | "all" | "mutations" | "writes" | "reads" | undefined;
}>, {
    order: number;
    scope: "unknown" | "all" | "mutations" | "writes" | "reads";
    description?: string | undefined;
    before?: {
        options: Record<string, unknown>;
        class_path: string;
    } | undefined;
    after?: {
        options: Record<string, unknown>;
        class_path: string;
    } | undefined;
}, {
    order?: number | undefined;
    description?: string | undefined;
    before?: {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    } | undefined;
    after?: {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    } | undefined;
    scope?: "unknown" | "all" | "mutations" | "writes" | "reads" | undefined;
}>;
/** Guards keyed by name. The name is an identifier, not a phase encoding. */
export declare const GuardsSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
    description: z.ZodOptional<z.ZodString>;
    /**
     * `writes` costs nothing on a read: the pipeline only resolves which files
     * a call touches when a guard asks for it.
     */
    scope: z.ZodDefault<z.ZodEnum<["all", "mutations", "writes", "reads", "unknown"]>>;
    /** Lower runs first before the call, and last after it. */
    order: z.ZodDefault<z.ZodNumber>;
    /** Runs before the call. Denying here means the call never happens. */
    before: z.ZodOptional<z.ZodObject<{
        class_path: z.ZodString;
        options: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        options: Record<string, unknown>;
        class_path: string;
    }, {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    }>>;
    /** Runs after a successful call, and may replace its result. */
    after: z.ZodOptional<z.ZodObject<{
        class_path: z.ZodString;
        options: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        options: Record<string, unknown>;
        class_path: string;
    }, {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    }>>;
}, "strip", z.ZodTypeAny, {
    order: number;
    scope: "unknown" | "all" | "mutations" | "writes" | "reads";
    description?: string | undefined;
    before?: {
        options: Record<string, unknown>;
        class_path: string;
    } | undefined;
    after?: {
        options: Record<string, unknown>;
        class_path: string;
    } | undefined;
}, {
    order?: number | undefined;
    description?: string | undefined;
    before?: {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    } | undefined;
    after?: {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    } | undefined;
    scope?: "unknown" | "all" | "mutations" | "writes" | "reads" | undefined;
}>, {
    order: number;
    scope: "unknown" | "all" | "mutations" | "writes" | "reads";
    description?: string | undefined;
    before?: {
        options: Record<string, unknown>;
        class_path: string;
    } | undefined;
    after?: {
        options: Record<string, unknown>;
        class_path: string;
    } | undefined;
}, {
    order?: number | undefined;
    description?: string | undefined;
    before?: {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    } | undefined;
    after?: {
        class_path: string;
        options?: Record<string, unknown> | undefined;
    } | undefined;
    scope?: "unknown" | "all" | "mutations" | "writes" | "reads" | undefined;
}>>>;
export type GuardScope = z.infer<typeof GuardScopeSchema>;
export type GuardHook = z.infer<typeof GuardHookSchema>;
export type GuardDeclaration = z.infer<typeof GuardDeclarationSchema>;
export type GuardDeclarations = z.infer<typeof GuardsSchema>;