export type ExecutionMode = 'interactive' | 'ci' | 'agent';
/**
 * Three orthogonal capability flags an agent-mode invocation can grant.
 *
 *   - `autoApprove`     — OK to silently pick the `recommended` value when
 *                          the wizard would otherwise emit `needs_input`
 *                          and stop.
 *   - `allowWrites`     — OK for the inner agent to call write tools
 *                          (Edit, Write, MultiEdit, Bash mutations). When
 *                          false, the PreToolUse hook denies write attempts
 *                          and the wizard exits `WRITE_REFUSED`.
 *   - `allowDestructive`— OK to overwrite or delete files that already exist
 *                          in the repo, and OK to run destructive Bash
 *                          commands (rm -rf, git reset --hard, DROP TABLE).
 *                          For Edit/Write/MultiEdit/NotebookEdit, the
 *                          PreToolUse hook is responsible for checking
 *                          whether the target already exists and passing
 *                          `targetFileExists` to `evaluateWriteGate`. The
 *                          hook stat's the target before the call; this
 *                          interface defers the existence check rather
 *                          than performing I/O itself.
 *
 * The flags are designed to compose: most invocations want `autoApprove +
 * allowWrites` (today's `--yes` semantics); the new `plan` command wants
 * just `autoApprove` (so it can answer `needs_input` but never write); the
 * new `apply` command requires `allowWrites` and refuses to run without it.
 */
export interface CapabilityFlags {
    autoApprove: boolean;
    allowWrites: boolean;
    allowDestructive: boolean;
}
export interface ModeConfig extends CapabilityFlags {
    mode: ExecutionMode;
    jsonOutput: boolean;
    quiet: boolean;
}
export interface ResolveModeOpts {
    ci?: boolean;
    yes?: boolean;
    /**
     * `--auto-approve` — silently pick `recommended` when a `needs_input`
     * event would fire. Does NOT grant write permission on its own.
     */
    autoApprove?: boolean;
    /**
     * `--force` — OK to overwrite/delete existing files. Implies
     * `allowWrites` for ergonomic CLI use.
     */
    force?: boolean;
    agent?: boolean;
    json?: boolean;
    human?: boolean;
    isTTY: boolean;
    /**
     * When true, BOTH `autoApprove` and `allowWrites` must be granted
     * explicitly via `--auto-approve` / `--yes` / `--ci` / `--force`.
     * The bare `--agent` flag will NOT imply either capability. Despite
     * the "writes" in the name, `autoApprove` is also gated — a future
     * subcommand using this flag must pass `--auto-approve` (or higher)
     * even to silently pick `recommended` on `needs_input`. Used by the
     * `apply` subcommand and any other command that wants strict opt-in.
     * Default `false` preserves today's `--agent` behavior
     * (auto-approve + writes implied).
     */
    requireExplicitWrites?: boolean;
}
/**
 * Resolve the effective execution mode, output preferences, and capability
 * grants.
 *
 * Precedence for output format:
 *   --human           → force human output (overrides auto-detect)
 *   --json / --agent  → force structured JSON
 *   !isTTY            → auto-detect to JSON (piped to another program)
 *   default           → human
 *
 * Capability grants (additive, lowest to highest):
 *   --auto-approve    → autoApprove
 *   --yes / --ci      → autoApprove + allowWrites
 *   --force           → autoApprove + allowWrites + allowDestructive
 *   --agent (alone)   → autoApprove + allowWrites (unless `requireExplicitWrites`)
 *
 * `--json` produces machine-readable output WITHOUT any capability grants.
 * Use `--agent` when you also want auto-approval of prompts.
 */
export declare function resolveMode(opts: ResolveModeOpts): ModeConfig;
export type WriteGateDecision = {
    kind: 'allow';
} | {
    kind: 'deny';
    reason: string;
    resumeFlag: '--yes' | '--force';
};
/**
 * Decide whether a tool call should be permitted under the current
 * capability grants. Pure function — no I/O, easy to unit test.
 *
 *   - Write tools (Edit/Write/MultiEdit/NotebookEdit) require `allowWrites`.
 *   - Write tools targeting an existing file also require `allowDestructive`.
 *   - Bash commands matching destructive patterns require `allowDestructive`.
 *   - Everything else is allowed.
 *
 * The caller (PreToolUse hook) is responsible for checking the filesystem
 * and passing `context.targetFileExists` so this function can enforce the
 * `allowDestructive` contract without performing I/O itself.
 */
export declare function evaluateWriteGate(toolName: string, toolInput: unknown, caps: CapabilityFlags, context?: {
    targetFileExists?: boolean;
}): WriteGateDecision;
