import { a as parseAccessGroupAllowFromEntry, t as ACCESS_GROUP_ALLOW_FROM_PREFIX } from "./allow-from-BXARLg0R.js";
import { a as SecretResolverWarningCode, c as createResolverContext, d as isEnabledFlag, f as pushAssignment, h as SecretRefResolveCache, i as SecretResolverWarning, l as hasOwnProperty, m as pushWarning, n as SecretAssignment, o as applyResolvedAssignments, p as pushInactiveSurfaceWarning, r as SecretDefaults, s as collectSecretInputAssignment, t as ResolverContext, u as isChannelAccountEffectivelyEnabled } from "./runtime-shared-dXGdttcO.js";
import { a as SecretTargetExpected, i as SecretTargetConfigFile, n as DiscoveredConfigSecretTarget, o as SecretTargetRegistryEntry, r as ResolvedPlanTarget, s as SecretTargetShape, t as AuthProfileType } from "./target-registry-types-DdbSAgvX.js";
import { a as resolveAccessGroupAllowFromMatches, i as expandAllowFromWithAccessGroups, n as AccessGroupMembershipResolver, o as resolveAccessGroupAllowFromState, r as ResolvedAccessGroupAllowFromState, t as AccessGroupMembershipLookup } from "./access-groups-Csw5hgV7.js";
import { c as isRecord } from "./utils-DSrjARXN.js";
import { S as resolvePinnedHostnameWithPolicy, a as SsrFBlockedError, g as isPrivateNetworkAllowedByPolicy, o as SsrFPolicy, p as isBlockedHostnameOrIp, t as LookupFn, v as matchesHostnameAllowlist } from "./ssrf-skjEI_i5.js";
import { a as getHookType, c as HookExternalContentSource, d as resolveHookExternalContentSource, i as detectSuspiciousPatterns, l as isExternalHookSession, n as WrapExternalContentOptions, o as wrapExternalContent, r as buildSafeExternalPrompt, s as wrapWebContent, t as ExternalContentSource, u as mapHookExternalContentSource } from "./external-content-BpqxkZzw.js";
import { a as formatErrorMessage, i as extractErrorCode } from "./errors-D0VpUbWO.js";
import { a as filterSupplementalContextItems, i as evaluateSupplementalContextVisibility, n as ContextVisibilityDecisionReason, o as shouldIncludeSupplementalContext, r as ContextVisibilityKind, t as ContextVisibilityDecision } from "./context-visibility-DP6aEGRu.js";
import { i as generateSecureToken } from "./secure-random-C6rj1jbz.js";
import { a as resolveDmAllowState, c as resolveDmGroupAccessWithLists, d as resolvePinnedMainDmOwnerFromAllowlist, i as readStoreAllowFromForDmPolicy, l as resolveEffectiveAllowFromLists, n as DmGroupAccessDecision, o as resolveDmGroupAccessDecision, r as DmGroupAccessReasonCode, s as resolveDmGroupAccessWithCommandGate, t as DM_GROUP_ACCESS_REASON, u as resolveOpenDmAllowlistAccess } from "./dm-policy-shared-BgMuswxr.js";
import { a as collectNestedChannelFieldAssignments, c as getChannelSurface, d as normalizeSecretStringValue, f as resolveChannelAccountSurface, i as collectConditionalChannelFieldAssignments, l as hasConfiguredSecretInputValue, n as ChannelAccountPredicate, o as collectSimpleChannelFieldAssignments, r as ChannelAccountSurface, s as getChannelRecord, t as ChannelAccountEntry, u as isBaseFieldActiveForChannelSurface } from "./channel-secret-basic-runtime-qLnualsT.js";
import { a as parseEnvValue, c as writeJsonFileSecure, i as parseDotPath, l as writeTextFileAtomic, n as isNonEmptyString, o as readTextFileIfExists, r as normalizePositiveInt, s as toDotPath, t as ensureDirForFile } from "./shared-Ry8G5o-u.js";
import { t as collectNestedChannelTtsAssignments } from "./channel-secret-tts-runtime-D3D36UHl.js";
import { r as resolvePreferredNodmixTmpDir } from "./tmp-nodmix-dir-BPGEieXK.js";
import { a as hasProxyEnvConfigured } from "./proxy-env-C3y9mYGC.js";
import { _ as resolveAbsolutePathForWrite, a as ExternalFileWriteResult$1, c as ResolvedAbsolutePath, d as canonicalPathFromExistingAncestor, f as ensureAbsoluteDirectory, g as resolveAbsolutePathForRead, i as ExternalFileWriteOptions$1, l as ResolvedWritableAbsolutePath, n as EnsureAbsoluteDirectoryOptions, o as FsSafeErrorCode, p as findExistingAncestor, r as EnsureAbsoluteDirectoryResult, s as OpenResult, t as AbsolutePathSymlinkPolicy, u as assertAbsolutePathInput } from "./fs-safe-D8QsyJ_h.js";
import { t as normalizeHostname } from "./hostname-Zu_LBkSa.js";
import { d as redactSensitiveText } from "./redact-GCfg0uWg.js";

//#region src/security/channel-metadata.d.ts
declare function buildUntrustedChannelMetadata(params: {
  source: string;
  label: string;
  entries: Array<string | null | undefined>;
  maxChars?: number;
}): string | undefined;
//#endregion
//#region src/security/safe-regex.d.ts
type SafeRegexRejectReason = "empty" | "unsafe-nested-repetition" | "invalid-regex";
type SafeRegexCompileResult = {
  regex: RegExp;
  source: string;
  flags: string;
  reason: null;
} | {
  regex: null;
  source: string;
  flags: string;
  reason: SafeRegexRejectReason;
};
declare function testRegexWithBoundedInput(regex: RegExp, input: string, maxWindow?: number): boolean;
declare function hasNestedRepetition(source: string): boolean;
declare function compileSafeRegexDetailed(source: string, flags?: string): SafeRegexCompileResult;
declare function compileSafeRegex(source: string, flags?: string): RegExp | null;
//#endregion
//#region src/infra/path-guards.d.ts
declare function isNotFoundPathError(...args: any[]): any;
declare function isPathInside(...args: any[]): any;
//#endregion
//#region src/infra/fs-safe-advanced.d.ts
declare function assertNoSymlinkParents(...args: any[]): any;
declare function assertNoSymlinkParentsSync(...args: any[]): any;
declare function sanitizeUntrustedFileName(...args: any[]): any;
declare function writeViaSiblingTempPath(...args: any[]): any;
//#endregion
//#region src/infra/private-file-store.d.ts
type PrivateFileStore = import("@nodmix/fs-safe/store").FileStore;
declare function privateFileStore(rootDir: string): PrivateFileStore;
type PrivateFileStoreSync = import("@nodmix/fs-safe/store").FileStoreSync;
declare function privateFileStoreSync(rootDir: string): PrivateFileStoreSync;
//#endregion
//#region src/infra/replace-file.d.ts
declare function replaceFileAtomicSync(...args: any[]): any;
declare const replaceFileAtomic: any;
type ReplaceFileAtomicFileSystem = import("@nodmix/fs-safe/atomic").ReplaceFileAtomicFileSystem;
type ReplaceFileAtomicOptions = import("@nodmix/fs-safe/atomic").ReplaceFileAtomicOptions;
type ReplaceFileAtomicResult = import("@nodmix/fs-safe/atomic").ReplaceFileAtomicResult;
type ReplaceFileAtomicSyncFileSystem = import("@nodmix/fs-safe/atomic").ReplaceFileAtomicSyncFileSystem;
type ReplaceFileAtomicSyncOptions = import("@nodmix/fs-safe/atomic").ReplaceFileAtomicSyncOptions;
type MovePathWithCopyFallbackOptions = import("@nodmix/fs-safe/atomic").MovePathWithCopyFallbackOptions & {
  sourceHardlinks?: "allow" | "reject";
};
declare function movePathWithCopyFallback(options: MovePathWithCopyFallbackOptions): Promise<void>;
//#endregion
//#region src/infra/sibling-temp-file.d.ts
declare function writeSiblingTempFile(...args: any[]): any;
type WriteSiblingTempFileOptions<T = any> = import("@nodmix/fs-safe/advanced").WriteSiblingTempFileOptions<T>;
type WriteSiblingTempFileResult<T = any> = import("@nodmix/fs-safe/advanced").WriteSiblingTempFileResult<T>;
//#endregion
//#region src/infra/ports.d.ts
declare function ensurePortAvailable(port: number): Promise<void>;
//#endregion
//#region src/infra/root-paths.d.ts
declare function pathScope(...args: any[]): any;
declare function resolveExistingPathsWithinRoot(...args: any[]): any;
declare function resolvePathWithinRoot(...args: any[]): any;
declare function resolvePathsWithinRoot(...args: any[]): any;
declare function resolveStrictExistingPathsWithinRoot(...args: any[]): any;
declare function resolveWritablePathWithinRoot(...args: any[]): any;
//#endregion
//#region src/security/secret-equal.d.ts
declare function safeEqualSecret(provided: string | undefined | null, expected: string | undefined | null): boolean;
//#endregion
//#region src/plugin-sdk/security-runtime.d.ts
declare function appendRegularFile(...args: any[]): any;
declare function appendRegularFileSync(...args: any[]): any;
declare const FsSafeError: any;
declare const SafeOpenError: any;
type SafeOpenErrorCode = FsSafeErrorCode;
declare function openLocalFileSafely(...args: any[]): any;
declare function pathExists(...args: any[]): any;
declare function pathExistsSync(...args: any[]): any;
declare function readRegularFile(...args: any[]): any;
declare function resolveLocalPathFromRootsSync(...args: any[]): any;
declare function readRegularFileSync(...args: any[]): any;
declare function resolveRegularFileAppendFlags(...args: any[]): any;
declare function root(...args: any[]): any;
declare function statRegularFile(...args: any[]): any;
declare function statRegularFileSync(...args: any[]): any;
declare function writeExternalFileWithinRoot(...args: any[]): Promise<any>;
declare function withTimeout<T = any>(promise: Promise<T> | (() => Promise<T>), ms: number): any;
type ExternalFileWriteOptions = ExternalFileWriteOptions$1;
type ExternalFileWriteResult = ExternalFileWriteResult$1;
declare function openFileWithinRoot(params: {
  rootDir: string;
  relativePath: string;
  rejectHardlinks?: boolean;
  nonBlockingRead?: boolean;
  allowSymlinkTargetWithinRoot?: boolean;
}): Promise<OpenResult>;
declare function writeFileFromPathWithinRoot(params: {
  rootDir: string;
  relativePath: string;
  sourcePath: string;
  mkdir?: boolean;
}): Promise<void>;
type AssertNoSymlinkParentsOptions = import("@nodmix/fs-safe/advanced").AssertNoSymlinkParentsOptions;
//#endregion
export { ACCESS_GROUP_ALLOW_FROM_PREFIX, type AbsolutePathSymlinkPolicy, type AccessGroupMembershipLookup, type AccessGroupMembershipResolver, AssertNoSymlinkParentsOptions, type AuthProfileType, type ChannelAccountEntry, type ChannelAccountPredicate, type ChannelAccountSurface, ContextVisibilityDecision, ContextVisibilityDecisionReason, ContextVisibilityKind, DM_GROUP_ACCESS_REASON, type DiscoveredConfigSecretTarget, DmGroupAccessDecision, DmGroupAccessReasonCode, type EnsureAbsoluteDirectoryOptions, type EnsureAbsoluteDirectoryResult, ExternalContentSource, ExternalFileWriteOptions, ExternalFileWriteResult, FsSafeError, type HookExternalContentSource, type LookupFn, type MovePathWithCopyFallbackOptions, type PrivateFileStore, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicResult, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, type ResolvedAbsolutePath, type ResolvedAccessGroupAllowFromState, type ResolvedPlanTarget, type ResolvedWritableAbsolutePath, ResolverContext, SafeOpenError, SafeOpenErrorCode, SafeRegexCompileResult, SafeRegexRejectReason, SecretAssignment, SecretDefaults, type SecretRefResolveCache, SecretResolverWarning, SecretResolverWarningCode, type SecretTargetConfigFile, type SecretTargetExpected, type SecretTargetRegistryEntry, type SecretTargetShape, SsrFBlockedError, type SsrFPolicy, WrapExternalContentOptions, type WriteSiblingTempFileOptions, type WriteSiblingTempFileResult, appendRegularFile, appendRegularFileSync, applyResolvedAssignments, assertAbsolutePathInput, assertNoSymlinkParents, assertNoSymlinkParentsSync, buildSafeExternalPrompt, buildUntrustedChannelMetadata, canonicalPathFromExistingAncestor, collectConditionalChannelFieldAssignments, collectNestedChannelFieldAssignments, collectNestedChannelTtsAssignments, collectSecretInputAssignment, collectSimpleChannelFieldAssignments, compileSafeRegex, compileSafeRegexDetailed, createResolverContext, detectSuspiciousPatterns, ensureAbsoluteDirectory, ensureDirForFile, ensurePortAvailable, evaluateSupplementalContextVisibility, expandAllowFromWithAccessGroups, extractErrorCode, filterSupplementalContextItems, findExistingAncestor, formatErrorMessage, generateSecureToken, getChannelRecord, getChannelSurface, getHookType, hasConfiguredSecretInputValue, hasNestedRepetition, hasOwnProperty, hasProxyEnvConfigured, isBaseFieldActiveForChannelSurface, isBlockedHostnameOrIp, isChannelAccountEffectivelyEnabled, isEnabledFlag, isExternalHookSession, isNonEmptyString, isNotFoundPathError, isPathInside, isPrivateNetworkAllowedByPolicy, isRecord, mapHookExternalContentSource, matchesHostnameAllowlist, movePathWithCopyFallback, normalizeHostname, normalizePositiveInt, normalizeSecretStringValue, openFileWithinRoot, openLocalFileSafely, parseAccessGroupAllowFromEntry, parseDotPath, parseEnvValue, pathExists, pathExistsSync, pathScope, privateFileStore, privateFileStoreSync, pushAssignment, pushInactiveSurfaceWarning, pushWarning, readRegularFile, readRegularFileSync, readStoreAllowFromForDmPolicy, readTextFileIfExists, redactSensitiveText, replaceFileAtomic, replaceFileAtomicSync, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, resolveAccessGroupAllowFromMatches, resolveAccessGroupAllowFromState, resolveChannelAccountSurface, resolveDmAllowState, resolveDmGroupAccessDecision, resolveDmGroupAccessWithCommandGate, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists, resolveExistingPathsWithinRoot, resolveHookExternalContentSource, resolveLocalPathFromRootsSync, resolveOpenDmAllowlistAccess, resolvePathWithinRoot, resolvePathsWithinRoot, resolvePinnedHostnameWithPolicy, resolvePinnedMainDmOwnerFromAllowlist, resolvePreferredNodmixTmpDir, resolveRegularFileAppendFlags, resolveStrictExistingPathsWithinRoot, resolveWritablePathWithinRoot, root, safeEqualSecret, sanitizeUntrustedFileName, shouldIncludeSupplementalContext, statRegularFile, statRegularFileSync, testRegexWithBoundedInput, toDotPath, withTimeout, wrapExternalContent, wrapWebContent, writeExternalFileWithinRoot, writeFileFromPathWithinRoot, writeJsonFileSecure, writeSiblingTempFile, writeTextFileAtomic, writeViaSiblingTempPath };