import type { AgentId, PermissionSet } from './types.js';
/** Canonical tool (lowercased) -> Grok's lowercase tool vocabulary. */
export declare const GROK_TOOL_BY_CANONICAL: Record<string, string | undefined>;
/** Canonical tool -> OpenClaw tool id (tool-level granularity only). */
export declare const CANONICAL_TO_OPENCLAW_TOOL: Record<string, string>;
/** Canonical tool -> Antigravity's action namespace. */
export declare const ANTIGRAVITY_ACTION_BY_TOOL: Record<string, string | undefined>;
/** Filename Codex stores generated deny rules under `.codex/rules/`. */
export declare const CODEX_RULES_FILENAME = "agents-deny.rules";
/**
 * Strip JSON comments for JSONC parsing, only OUTSIDE string literals.
 *
 * A naive `//`-to-end-of-line regex destroys
 * `"$schema": "https://opencode.ai/config.json"` — which every
 * opencode-generated config carries — so the file then fails to parse and its
 * permissions read back as absent, the very defect this registry exists to fix.
 * Exported so `permissions.ts` shares this one implementation instead of
 * keeping its own copy.
 */
export declare function stripJsonComments(content: string): string;
/** The complete permissions contract for one agent. */
export interface PermissionTarget {
    /** Permissions file under a HOME root (a version home, or the real HOME). */
    home(home: string): string;
    /** Permissions file for a project checkout, when the harness reads one. */
    project?: (cwd: string) => string;
    /**
     * Read `configPath` and project it to canonical form. Returns null when the
     * file is absent, unreadable, or records no permissions — never throws.
     */
    toCanonical(configPath: string): PermissionSet | null;
    /** One line naming what this harness's shape loses on the way back. */
    lossyBecause: string;
    /**
     * Extra path suffixes this harness's config may use, for DETECTION only.
     *
     * `home()`/`project()` may probe the filesystem to pick between accepted
     * spellings, which is correct when resolving a real root but meaningless for
     * detection — `detectPermissionAgentFromPath` passes `''`, so the probe would
     * resolve against `process.cwd()` and make the same input detect differently
     * depending on where the CLI was run.
     *
     * Detection still calls `home('')`/`project('')`, since most targets are pure
     * `path.join` and need no entry. A target whose resolver probes MUST list
     * EVERY spelling it can return — that is what makes the probe's answer
     * irrelevant rather than unreachable. `existingOr` (opencode) is the only
     * probing resolver today; `permissions-registry.test.ts` pins the invariant
     * for the whole table rather than leaving it as prose.
     */
    altSuffixes?: string[];
}
/**
 * Single source of truth for where each allowlist-capable agent stores
 * permissions and how to read them back. Keys MUST equal
 * `capableAgents('allowlist')` — pinned by `permissions-registry.test.ts`.
 */
export declare const PERMISSION_TARGETS: Partial<Record<AgentId, PermissionTarget>>;
/** The registry entry for `agent`, or undefined when it stores no permissions. */
export declare function permissionTarget(agent: AgentId): PermissionTarget | undefined;
/**
 * Read `agent`'s permissions from `home` (a version home or the real HOME) and
 * project them to canonical form. `scope: 'project'` reads the repo-local file
 * for the harnesses that have one, and returns null for those that do not.
 */
export declare function readCanonicalPermissions(agent: AgentId, scope?: 'user' | 'project', cwd?: string, home?: string): PermissionSet | null;
