import { z } from "zod";
import { type PermissionMode } from "./protocol.js";
/**
 * The owner's release authority policy: per project, which release-type
 * actions a conductor may send a worker to do on its own (`go`) and which need
 * the owner's word each time (`ask`). It only restricts: nothing here lifts a
 * worker's own permission checks. See docs/authority.md.
 */
export declare const RELEASE_ACTIONS: readonly ["merge", "publish", "deploy", "app-store", "github-admin"];
export type ReleaseAction = typeof RELEASE_ACTIONS[number];
export declare const releaseAction: z.ZodEnum<{
    "app-store": "app-store";
    deploy: "deploy";
    "github-admin": "github-admin";
    merge: "merge";
    publish: "publish";
}>;
declare const writer: z.ZodEnum<{
    cli: "cli";
    phone: "phone";
}>;
export type AuthorityWriter = z.infer<typeof writer>;
export declare const projectEntrySchema: z.ZodObject<{
    default: z.ZodOptional<z.ZodEnum<{
        ask: "ask";
        go: "go";
    }>>;
    actions: z.ZodOptional<z.ZodObject<{
        merge: z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
        publish: z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
        deploy: z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
        "app-store": z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
        "github-admin": z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
    }, z.core.$strict>>;
    maxPermissionMode: z.ZodOptional<z.ZodEnum<{
        auto: "auto";
        "auto-edits": "auto-edits";
        "full-access": "full-access";
        supervised: "supervised";
    }>>;
    note: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export type ProjectEntry = z.infer<typeof projectEntrySchema>;
declare const fileSchema: z.ZodObject<{
    projects: z.ZodRecord<z.ZodString, z.ZodObject<{
        default: z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
        actions: z.ZodOptional<z.ZodObject<{
            merge: z.ZodOptional<z.ZodEnum<{
                ask: "ask";
                go: "go";
            }>>;
            publish: z.ZodOptional<z.ZodEnum<{
                ask: "ask";
                go: "go";
            }>>;
            deploy: z.ZodOptional<z.ZodEnum<{
                ask: "ask";
                go: "go";
            }>>;
            "app-store": z.ZodOptional<z.ZodEnum<{
                ask: "ask";
                go: "go";
            }>>;
            "github-admin": z.ZodOptional<z.ZodEnum<{
                ask: "ask";
                go: "go";
            }>>;
        }, z.core.$strict>>;
        maxPermissionMode: z.ZodOptional<z.ZodEnum<{
            auto: "auto";
            "auto-edits": "auto-edits";
            "full-access": "full-access";
            supervised: "supervised";
        }>>;
        note: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>;
    updatedAt: z.ZodOptional<z.ZodString>;
    updatedBy: z.ZodOptional<z.ZodEnum<{
        cli: "cli";
        phone: "phone";
    }>>;
}, z.core.$strict>;
export type AuthorityFile = z.infer<typeof fileSchema>;
/** Used until the owner first writes the policy: no project is restricted. */
export declare const DEFAULT_AUTHORITY: AuthorityFile;
/** The permission ceiling of a project with any ask-first action that names none. */
export declare const ASK_FIRST_PERMISSION_MODE: PermissionMode;
export interface AuthorityPolicy extends AuthorityFile {
    source: "file" | "defaults";
}
/** The saved policy, or the built-in defaults when the owner has written none.
 * A file that is not private or does not parse is an error, never "no policy". */
export declare function readAuthority(root?: string): Promise<AuthorityPolicy>;
export interface ProjectAuthority {
    project: string;
    /** The policy names this project; an unlisted one is go for everything. */
    listed: boolean;
    go: ReleaseAction[];
    ask: ReleaseAction[];
    maxPermissionMode?: PermissionMode;
    note?: string;
    /** One sentence a conductor quotes in a brief. */
    line: string;
}
export declare function projectAuthority(policy: Pick<AuthorityFile, "projects">, project: string): ProjectAuthority;
/** The lower of two permission ceilings; undefined is no ceiling. */
export declare function lowerMode(a: PermissionMode | undefined, b: PermissionMode | undefined): PermissionMode | undefined;
export declare const setAuthoritySchema: z.ZodObject<{
    default: z.ZodOptional<z.ZodEnum<{
        ask: "ask";
        go: "go";
    }>>;
    actions: z.ZodOptional<z.ZodObject<{
        merge: z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
        publish: z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
        deploy: z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
        "app-store": z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
        "github-admin": z.ZodOptional<z.ZodEnum<{
            ask: "ask";
            go: "go";
        }>>;
    }, z.core.$strict>>;
    maxPermissionMode: z.ZodOptional<z.ZodEnum<{
        auto: "auto";
        "auto-edits": "auto-edits";
        "full-access": "full-access";
        supervised: "supervised";
    }>>;
    note: z.ZodOptional<z.ZodString>;
    project: z.ZodString;
}, z.core.$strict>;
/** Replace one project's entry. The first write saves the defaults with it. */
export declare function setProjectAuthority(input: unknown, by: AuthorityWriter, root?: string): Promise<ProjectAuthority>;
/** Drop one project's entry, which makes it go for everything. */
export declare function clearProjectAuthority(input: unknown, by: AuthorityWriter, root?: string): Promise<ProjectAuthority>;
declare const confirmationSchema: z.ZodObject<{
    id: z.ZodString;
    project: z.ZodString;
    actions: z.ZodArray<z.ZodEnum<{
        "app-store": "app-store";
        deploy: "deploy";
        "github-admin": "github-admin";
        merge: "merge";
        publish: "publish";
    }>>;
    confirmedAt: z.ZodString;
    expiresAt: z.ZodString;
    by: z.ZodEnum<{
        cli: "cli";
        phone: "phone";
    }>;
}, z.core.$strict>;
export type Confirmation = z.infer<typeof confirmationSchema>;
export declare const confirmInputSchema: z.ZodObject<{
    project: z.ZodString;
    actions: z.ZodArray<z.ZodEnum<{
        "app-store": "app-store";
        deploy: "deploy";
        "github-admin": "github-admin";
        merge: "merge";
        publish: "publish";
    }>>;
    minutes: z.ZodOptional<z.ZodNumber>;
}, z.core.$strict>;
export declare const DEFAULT_CONFIRMATION_MINUTES = 30;
/** Confirmations still waiting to be used. */
export declare function listConfirmations(root?: string): Promise<Confirmation[]>;
/** The owner's word for one agent dispatch of these release actions to this project. */
export declare function confirmAuthority(input: unknown, by: AuthorityWriter, root?: string): Promise<Confirmation>;
/** Use up the oldest confirmation that covers every one of `actions` for
 * `project`, or return undefined when none does. */
export declare function consumeConfirmation(project: string, actions: readonly ReleaseAction[], root?: string): Promise<Confirmation | undefined>;
export interface AuthorityCheck {
    /** The permission mode the worker should start in, when the policy sets one the call did not. */
    permissionMode?: PermissionMode;
    authority: ProjectAuthority;
    confirmation?: Confirmation;
}
/**
 * What the policy asks of an agent's dispatch: refuse a mode above the
 * project's ceiling (lowered further by `grantCeiling`), start one that named
 * no mode at that ceiling, and refuse an ask-first release action the owner
 * has not confirmed. Only an agent's call is checked; the owner's never is.
 * The confirmation is used up only when everything else passed.
 */
export declare function checkAgentDispatch(data: {
    project: string;
    harness: string;
    permissionMode?: PermissionMode;
    releaseActions?: readonly ReleaseAction[];
}, grantCeiling: PermissionMode, root?: string): Promise<AuthorityCheck>;
export {};