import type { SessionAuthContext } from "#channel/types.js";
/** Principal and channel that requested a deployed source modification. */
export interface SelfModificationAuthorizationContext {
    readonly channel: {
        /** Channel adapter family, such as `"slack"` or `"http"`. */
        readonly kind?: string;
        readonly metadata?: Readonly<Record<string, unknown>>;
    };
    readonly principal: SessionAuthContext | null;
}
/** Decides whether a principal may use deployed self-modification. */
export type SelfModificationAuthorization = (context: SelfModificationAuthorizationContext) => boolean | Promise<boolean>;
export interface GitHubRepository {
    readonly owner: string;
    readonly repo: string;
}
export type GitHubCredentialCapability = "checkout" | "publish";
export interface GitHubCredentialRequest {
    readonly capability: GitHubCredentialCapability;
    readonly repository: GitHubRepository;
}
/** Application-supplied GitHub credentials for deployed self-modification. */
export interface GitHubCredentialProvider {
    resolve(request: GitHubCredentialRequest): Promise<string>;
}
export interface SelfModificationConfig {
    readonly local?: {
        readonly enabled?: boolean;
    };
    readonly deployed?: {
        readonly source: {
            readonly git: {
                /** GitHub repository in github.com/owner/repository form. */
                readonly repository: string;
                /** Application directory relative to the repository root. */
                readonly directory: string;
            };
        };
        readonly target: {
            readonly branch: string;
        };
        /** Fail-closed policy for principals that may create draft proposals. */
        readonly authorize: SelfModificationAuthorization;
        readonly credentials?: GitHubCredentialProvider | {
            /**
             * Self-hosted exception. Reads `EVE_SELF_MODIFICATION_GITHUB_TOKEN` from
             * the trusted deployment environment; never injects it into the sandbox.
             */
            readonly pat: true;
        };
    };
}
export interface ResolvedSelfModificationConfig {
    readonly localEnabled: boolean;
    readonly deployed?: ResolvedDeployedSelfModificationConfig;
}
export interface ResolvedDeployedSelfModificationConfig {
    readonly authorize: SelfModificationAuthorization;
    readonly credentials: ResolvedGitHubCredentials;
    readonly directory: string;
    readonly repository: GitHubRepository;
    readonly targetBranch: string;
}
export type ResolvedGitHubCredentials = {
    readonly kind: "pat";
} | {
    readonly kind: "provider";
    readonly provider: GitHubCredentialProvider;
};
/** Defines the policy shared by the self-modification agent, sandbox, and extension. */
export declare function defineSelfModificationConfig(config?: SelfModificationConfig): SelfModificationConfig;
export declare function resolveSelfModificationConfig(config?: SelfModificationConfig): ResolvedSelfModificationConfig;