/**
 * Workflow Types for Relay Cloud Swarm Patterns
 *
 * Shared TypeScript types for relay.yaml configuration, workflow execution,
 * and database row representations.
 */
export * from '@agent-relay/workflow-types';
// ── Type guards ─────────────────────────────────────────────────────────────
/**
 * Returns true if the agent has restricted permissions —
 * i.e., it has explicit permissions set AND those permissions limit access
 * beyond the default readwrite+inherit behavior.
 *
 * An agent is considered restricted if any of the following are true:
 *   - access is 'readonly' or 'restricted'
 *   - files.deny has entries
 *   - network is false or an allowlist/denylist object
 *   - exec allowlist is set (any commands at all = restricted execution)
 *   - inherit is explicitly false (opts out of dotfile protections)
 */
export function isRestrictedAgent(agent) {
    const perms = agent.permissions;
    if (!perms)
        return false;
    if (perms.access === 'readonly' || perms.access === 'restricted')
        return true;
    if (perms.files?.deny && perms.files.deny.length > 0)
        return true;
    if (perms.network === false || (typeof perms.network === 'object' && perms.network !== null))
        return true;
    if (perms.exec && perms.exec.length > 0)
        return true;
    if (perms.inherit === false)
        return true;
    return false;
}
//# sourceMappingURL=types.js.map