@guilz-dev/belay 0.1.0

package/dist/adapters/cursor/adapter.d.ts

@@ -0,0 +1,7 @@
+import type { BelayAdapter } from '../types.js';
+export declare const cursorAdapter: BelayAdapter;
+export declare function cursorPaths(repoRoot: string): {
+    config: string;
+    hooks: string;
+    runtime: string;
+};

package/dist/adapters/cursor/adapter.js

@@ -0,0 +1,29 @@
+import path from 'node:path';
+import { doctorProject } from '../../commands/doctor.js';
+import { getManagedHookEntries } from '../../defaults.js';
+import { initCursorProject, upgradeCursorProject } from '../../installer.js';
+import { cursorLayout } from '../layouts/cursor.js';
+export const cursorAdapter = {
+    name: 'cursor',
+    layout: cursorLayout,
+    async install(repoRoot, options = {}) {
+        return initCursorProject({ ...options, targetDir: repoRoot });
+    },
+    async upgrade(repoRoot, options = {}) {
+        return upgradeCursorProject({ ...options, targetDir: repoRoot });
+    },
+    async doctor(options = {}) {
+        return doctorProject({ ...options, adapter: 'cursor' });
+    },
+    hookEvents() {
+        return getManagedHookEntries(process.platform);
+    },
+};
+export function cursorPaths(repoRoot) {
+    const resolved = path.resolve(repoRoot);
+    return {
+        config: cursorLayout.configPath(resolved),
+        hooks: cursorLayout.hooksSettingsPath(resolved),
+        runtime: path.join(cursorLayout.runtimeDir(resolved), 'core.mjs'),
+    };
+}

package/dist/adapters/cursor/hooks.d.ts

@@ -0,0 +1,2 @@
+import type { HooksFile } from '../../types.js';
+export declare function mergeCursorHooksFile(current: HooksFile, platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HooksFile;

package/dist/adapters/cursor/hooks.js

@@ -0,0 +1,26 @@
+import { getManagedHookEntries } from '../../defaults.js';
+function entryMatches(existing, expected) {
+    return existing.command === expected.command && existing.matcher === expected.matcher;
+}
+function mergeHookEntry(current, expected, placement) {
+    const entries = Array.isArray(current) ? [...current] : [];
+    const filtered = entries.filter((entry) => !entryMatches(entry, expected));
+    if (placement === 'prepend') {
+        return [expected, ...filtered];
+    }
+    return [...filtered, expected];
+}
+export function mergeCursorHooksFile(current, platform, hooksDir, repoRoot) {
+    const next = {
+        version: current.version || 1,
+        hooks: { ...current.hooks },
+    };
+    const managedEntries = getManagedHookEntries(platform, hooksDir, repoRoot);
+    for (const { event, definition } of managedEntries) {
+        next.hooks[event] = mergeHookEntry(next.hooks[event], {
+            command: definition.command,
+            matcher: definition.matcher,
+        }, definition.placement);
+    }
+    return next;
+}

package/dist/adapters/cursor/runtime-entry.d.ts

@@ -0,0 +1,4 @@
+export declare function runBeforeSubmitPromptHook(): Promise<void>;
+export declare function runShellGateHook(): Promise<void>;
+export declare function runToolGateHook(eventName: string): Promise<void>;
+export declare function runAuditHook(eventName: string): Promise<void>;

package/dist/adapters/cursor/runtime-entry.js

@@ -0,0 +1,143 @@
+import process from 'node:process';
+import { cursorLayout } from '../layouts/cursor.js';
+import { appendObservedAudit, createDefaultGateRuntimeDeps, evaluateGatedAction, gateVerdictToCursorResponse, processApprovalPrompt, resolveGateConfig, } from '../shared/gate-runtime.js';
+import { findRepoRoot } from '../shared/repo-root.js';
+async function readStdinJson() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(typeof chunk === 'string' ? chunk : chunk.toString('utf8'));
+    }
+    const raw = chunks.join('').trim();
+    if (!raw) {
+        return {};
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+function jsonResponse(value) {
+    process.stdout.write(`${JSON.stringify(value)}\n`);
+}
+async function loadRuntimeContext(cwd) {
+    const repoRoot = findRepoRoot(cwd, cursorLayout);
+    const configPath = cursorLayout.configPath(repoRoot);
+    const deps = createDefaultGateRuntimeDeps();
+    const config = await resolveGateConfig({ layout: cursorLayout, repoRoot, configPath }, deps);
+    return { layout: cursorLayout, repoRoot, config, configPath };
+}
+function isSubagentEvent(payload, eventName) {
+    return eventName === 'subagentStart' || payload.subagent_type !== undefined;
+}
+function isFileMutationTool(toolName) {
+    return toolName === 'Write' || toolName === 'StrReplace' || toolName === 'Delete';
+}
+export async function runBeforeSubmitPromptHook() {
+    try {
+        const payload = await readStdinJson();
+        const prompt = String(payload.prompt ?? '');
+        const ctx = await loadRuntimeContext(process.cwd());
+        const deps = createDefaultGateRuntimeDeps();
+        const result = await processApprovalPrompt(ctx, deps, prompt);
+        jsonResponse({
+            continue: result.continue,
+            ...(result.user_message ? { user_message: result.user_message } : {}),
+        });
+    }
+    catch {
+        jsonResponse({
+            continue: false,
+            user_message: 'belay failed while processing approval state. Run belay doctor, then retry.',
+        });
+    }
+}
+export async function runShellGateHook() {
+    try {
+        const payload = await readStdinJson();
+        const command = String(payload.command ?? '').trim();
+        const cwd = String(payload.cwd ?? process.cwd()).trim() || process.cwd();
+        const ctx = await loadRuntimeContext(cwd);
+        const deps = createDefaultGateRuntimeDeps();
+        const verdict = await evaluateGatedAction(ctx, deps, {
+            kind: 'shell',
+            cwd,
+            command,
+        });
+        jsonResponse(gateVerdictToCursorResponse(verdict));
+    }
+    catch {
+        jsonResponse({
+            permission: 'deny',
+            user_message: 'belay failed while classifying this shell command. Run belay doctor, then retry.',
+        });
+    }
+}
+export async function runToolGateHook(eventName) {
+    try {
+        const payload = await readStdinJson();
+        const cwd = process.cwd();
+        const ctx = await loadRuntimeContext(cwd);
+        const deps = createDefaultGateRuntimeDeps();
+        const toolName = String(payload.tool_name ?? '');
+        if (isSubagentEvent(payload, eventName)) {
+            const verdict = await evaluateGatedAction(ctx, deps, {
+                kind: 'subagent',
+                cwd,
+                payload,
+            });
+            jsonResponse(gateVerdictToCursorResponse(verdict));
+            return;
+        }
+        if (toolName === 'Shell') {
+            const verdict = await evaluateGatedAction(ctx, deps, {
+                kind: 'shell',
+                cwd,
+                payload,
+                toolName,
+            });
+            jsonResponse(gateVerdictToCursorResponse(verdict));
+            return;
+        }
+        if (isFileMutationTool(toolName)) {
+            const verdict = await evaluateGatedAction(ctx, deps, {
+                kind: 'tool',
+                cwd,
+                payload,
+                toolName,
+            });
+            jsonResponse(gateVerdictToCursorResponse(verdict));
+            return;
+        }
+        if (payload.tool_name === 'Task') {
+            const verdict = await evaluateGatedAction(ctx, deps, {
+                kind: 'subagent',
+                cwd,
+                payload,
+            });
+            jsonResponse(gateVerdictToCursorResponse(verdict));
+            return;
+        }
+        jsonResponse({ permission: 'allow' });
+    }
+    catch {
+        jsonResponse({
+            permission: 'deny',
+            user_message: 'belay failed while classifying this tool action. Run belay doctor, then retry.',
+        });
+    }
+}
+export async function runAuditHook(eventName) {
+    try {
+        const payload = await readStdinJson();
+        const ctx = await loadRuntimeContext(process.cwd());
+        const deps = createDefaultGateRuntimeDeps();
+        await appendObservedAudit(ctx, deps, eventName, payload);
+        jsonResponse({});
+    }
+    catch (error) {
+        console.error('belay audit hook failed:', error instanceof Error ? error.message : String(error));
+        jsonResponse({});
+    }
+}

package/dist/adapters/layouts/claude.d.ts

@@ -0,0 +1,2 @@
+import type { AdapterLayout } from './types.js';
+export declare const claudeLayout: AdapterLayout;

package/dist/adapters/layouts/claude.js

@@ -0,0 +1,40 @@
+import path from 'node:path';
+import { DEFAULT_CONFIG_V4 } from '../../core/config.js';
+import { buildRunnerInvocation } from './scope.js';
+function runnerCommand(platform, repoRoot, hookName, ...args) {
+    const hooksDir = path.join(path.resolve(repoRoot), '.claude', 'hooks');
+    return buildRunnerInvocation(platform, hooksDir, repoRoot, hookName, ...args);
+}
+export const claudeLayout = {
+    name: 'claude',
+    configPath(repoRoot) {
+        return path.join(repoRoot, '.claude', 'belay.config.json');
+    },
+    hooksSettingsPath(repoRoot) {
+        return path.join(repoRoot, '.claude', 'settings.json');
+    },
+    hooksDir(repoRoot) {
+        return path.join(repoRoot, '.claude', 'hooks');
+    },
+    runtimeDir(repoRoot) {
+        return path.join(repoRoot, '.claude', 'belay', 'runtime');
+    },
+    repoLocalStateDir(repoRoot) {
+        return path.join(repoRoot, '.claude', 'belay');
+    },
+    defaultAuditLogPath(_repoRoot) {
+        return path.join('.claude', 'belay', 'audit.ndjson');
+    },
+    repoRootMarkers: ['.git', '.claude'],
+    runnerCommand,
+    defaultConfig(repoRoot) {
+        return {
+            ...DEFAULT_CONFIG_V4,
+            adapter: 'claude',
+            audit: {
+                ...DEFAULT_CONFIG_V4.audit,
+                logPath: claudeLayout.defaultAuditLogPath(repoRoot),
+            },
+        };
+    },
+};

package/dist/adapters/layouts/codex.d.ts

@@ -0,0 +1,2 @@
+import type { AdapterLayout } from './types.js';
+export declare const codexLayout: AdapterLayout;

package/dist/adapters/layouts/codex.js

@@ -0,0 +1,43 @@
+import path from 'node:path';
+import { DEFAULT_CONFIG_V4 } from '../../core/config.js';
+import { buildRunnerInvocation } from './scope.js';
+function runnerCommand(platform, repoRoot, hookName, ...args) {
+    const hooksDir = path.join(path.resolve(repoRoot), '.codex', 'hooks');
+    return buildRunnerInvocation(platform, hooksDir, repoRoot, hookName, ...args);
+}
+// Codex hook config lives in `.codex/config.toml` (TOML `[[hooks.*]]`), distinct from
+// Claude's JSON `settings.json`. belay's own config stays JSON at `.codex/belay.config.json`.
+export const codexLayout = {
+    name: 'codex',
+    configPath(repoRoot) {
+        return path.join(repoRoot, '.codex', 'belay.config.json');
+    },
+    // Codex reads lifecycle hooks from `.codex/config.toml` (project layer).
+    hooksSettingsPath(repoRoot) {
+        return path.join(repoRoot, '.codex', 'config.toml');
+    },
+    hooksDir(repoRoot) {
+        return path.join(repoRoot, '.codex', 'hooks');
+    },
+    runtimeDir(repoRoot) {
+        return path.join(repoRoot, '.codex', 'belay', 'runtime');
+    },
+    repoLocalStateDir(repoRoot) {
+        return path.join(repoRoot, '.codex', 'belay');
+    },
+    defaultAuditLogPath(_repoRoot) {
+        return path.join('.codex', 'belay', 'audit.ndjson');
+    },
+    repoRootMarkers: ['.git', '.codex'],
+    runnerCommand,
+    defaultConfig(repoRoot) {
+        return {
+            ...DEFAULT_CONFIG_V4,
+            adapter: 'codex',
+            audit: {
+                ...DEFAULT_CONFIG_V4.audit,
+                logPath: codexLayout.defaultAuditLogPath(repoRoot),
+            },
+        };
+    },
+};

package/dist/adapters/layouts/cursor.d.ts

@@ -0,0 +1,2 @@
+import type { AdapterLayout } from './types.js';
+export declare const cursorLayout: AdapterLayout;

package/dist/adapters/layouts/cursor.js

@@ -0,0 +1,40 @@
+import path from 'node:path';
+import { DEFAULT_CONFIG_V4 } from '../../core/config.js';
+import { buildRunnerInvocation } from './scope.js';
+function runnerCommand(platform, repoRoot, hookName, ...args) {
+    const hooksDir = path.join(path.resolve(repoRoot), '.cursor', 'hooks');
+    return buildRunnerInvocation(platform, hooksDir, repoRoot, hookName, ...args);
+}
+export const cursorLayout = {
+    name: 'cursor',
+    configPath(repoRoot) {
+        return path.join(repoRoot, '.cursor', 'belay.config.json');
+    },
+    hooksSettingsPath(repoRoot) {
+        return path.join(repoRoot, '.cursor', 'hooks.json');
+    },
+    hooksDir(repoRoot) {
+        return path.join(repoRoot, '.cursor', 'hooks');
+    },
+    runtimeDir(repoRoot) {
+        return path.join(repoRoot, '.cursor', 'belay', 'runtime');
+    },
+    repoLocalStateDir(repoRoot) {
+        return path.join(repoRoot, '.cursor', 'belay');
+    },
+    defaultAuditLogPath(_repoRoot) {
+        return path.join('.cursor', 'belay', 'audit.ndjson');
+    },
+    repoRootMarkers: ['.git', '.cursor'],
+    runnerCommand,
+    defaultConfig(repoRoot) {
+        return {
+            ...DEFAULT_CONFIG_V4,
+            adapter: 'cursor',
+            audit: {
+                ...DEFAULT_CONFIG_V4.audit,
+                logPath: cursorLayout.defaultAuditLogPath(repoRoot),
+            },
+        };
+    },
+};

package/dist/adapters/layouts/index.d.ts

@@ -0,0 +1,7 @@
+import type { AdapterLayout, AdapterName } from './types.js';
+export { claudeLayout } from './claude.js';
+export { codexLayout } from './codex.js';
+export { cursorLayout } from './cursor.js';
+export type { AdapterLayout, AdapterName } from './types.js';
+export declare function getAdapterLayout(name?: AdapterName): AdapterLayout;
+export declare function detectAdapterLayout(repoRoot: string, existsSync: (path: string) => boolean): AdapterLayout;

package/dist/adapters/layouts/index.js

@@ -0,0 +1,23 @@
+import { claudeLayout } from './claude.js';
+import { codexLayout } from './codex.js';
+import { cursorLayout } from './cursor.js';
+export { claudeLayout } from './claude.js';
+export { codexLayout } from './codex.js';
+export { cursorLayout } from './cursor.js';
+const layouts = {
+    cursor: cursorLayout,
+    claude: claudeLayout,
+    codex: codexLayout,
+};
+export function getAdapterLayout(name = 'cursor') {
+    return layouts[name];
+}
+export function detectAdapterLayout(repoRoot, existsSync) {
+    if (existsSync(claudeLayout.configPath(repoRoot))) {
+        return claudeLayout;
+    }
+    if (existsSync(codexLayout.configPath(repoRoot))) {
+        return codexLayout;
+    }
+    return cursorLayout;
+}

package/dist/adapters/layouts/protected-paths.d.ts

@@ -0,0 +1,3 @@
+import type { AdapterLayout } from './types.js';
+/** Repo-local and optional out-of-repo paths that must never be mutated via overrides. */
+export declare function protectedArtifactRoots(layout: AdapterLayout, repoRoot: string, controlPlaneDir?: string | null): string[];

package/dist/adapters/layouts/protected-paths.js

@@ -0,0 +1,15 @@
+import path from 'node:path';
+/** Repo-local and optional out-of-repo paths that must never be mutated via overrides. */
+export function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
+    const roots = [
+        layout.configPath(repoRoot),
+        layout.hooksSettingsPath(repoRoot),
+        layout.hooksDir(repoRoot),
+        layout.repoLocalStateDir(repoRoot),
+        layout.runtimeDir(repoRoot),
+    ];
+    if (controlPlaneDir) {
+        roots.push(controlPlaneDir);
+    }
+    return roots.map((entry) => path.resolve(entry));
+}

package/dist/adapters/layouts/scope.d.ts

@@ -0,0 +1,19 @@
+import type { AdapterLayout } from './types.js';
+export type InstallScope = 'project' | 'global' | 'managed';
+export interface ScopedPaths {
+    scope: InstallScope;
+    repoRoot: string;
+    configPath: string;
+    hooksSettingsPath: string;
+    hooksDir: string;
+    runtimeDir: string;
+    repoLocalStateDir: string;
+    skillsDir: string;
+    commandsDir?: string;
+}
+export declare function isPathInside(child: string, parent: string): boolean;
+export declare function buildRunnerInvocation(platform: NodeJS.Platform, hooksDir: string, repoRoot: string, hookScript: string, ...args: string[]): string;
+export declare function resolveScopedPaths(layout: AdapterLayout, scope: InstallScope, repoRoot: string): ScopedPaths;
+export declare function resolveInstallScope(options: {
+    scope?: InstallScope;
+}, persisted?: 'project' | 'global', fallback?: 'project' | 'global'): 'project' | 'global';

package/dist/adapters/layouts/scope.js

@@ -0,0 +1,86 @@
+import os from 'node:os';
+import path from 'node:path';
+function agentHomeDir(adapter) {
+    const home = os.homedir();
+    if (adapter === 'cursor') {
+        return path.join(home, '.cursor');
+    }
+    if (adapter === 'claude') {
+        return path.join(home, '.claude');
+    }
+    return path.join(home, '.codex');
+}
+function projectAgentDir(adapter, repoRoot) {
+    if (adapter === 'cursor') {
+        return path.join(repoRoot, '.cursor');
+    }
+    if (adapter === 'claude') {
+        return path.join(repoRoot, '.claude');
+    }
+    return path.join(repoRoot, '.codex');
+}
+export function isPathInside(child, parent) {
+    const resolvedChild = path.resolve(child);
+    const resolvedParent = path.resolve(parent);
+    const relative = path.relative(resolvedParent, resolvedChild);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+export function buildRunnerInvocation(platform, hooksDir, repoRoot, hookScript, ...args) {
+    const runnerFile = platform === 'win32' ? 'belay-runner.cmd' : 'belay-runner';
+    const runnerAbs = path.resolve(hooksDir, runnerFile);
+    const relative = path.relative(path.resolve(repoRoot), runnerAbs);
+    const useRelative = relative.length > 0 && !relative.startsWith('..') && !path.isAbsolute(relative);
+    const runnerRef = useRelative
+        ? platform === 'win32'
+            ? `.\\${relative.split(path.sep).join('\\')}`
+            : `./${relative.split(path.sep).join('/')}`
+        : runnerAbs;
+    return [runnerRef, hookScript, ...args].join(' ');
+}
+export function resolveScopedPaths(layout, scope, repoRoot) {
+    const resolvedRepo = path.resolve(repoRoot);
+    const adapter = layout.name;
+    if (scope === 'managed') {
+        throw new Error('managed install scope is not implemented yet. Use --scope project (default) or --scope global.');
+    }
+    const projectAgent = projectAgentDir(adapter, resolvedRepo);
+    const project = {
+        scope: 'project',
+        repoRoot: resolvedRepo,
+        configPath: layout.configPath(resolvedRepo),
+        hooksSettingsPath: layout.hooksSettingsPath(resolvedRepo),
+        hooksDir: layout.hooksDir(resolvedRepo),
+        runtimeDir: layout.runtimeDir(resolvedRepo),
+        repoLocalStateDir: layout.repoLocalStateDir(resolvedRepo),
+        skillsDir: path.join(projectAgent, 'skills', 'belay'),
+        commandsDir: adapter === 'cursor' ? path.join(projectAgent, 'commands') : undefined,
+    };
+    if (scope === 'project') {
+        return project;
+    }
+    const globalAgent = agentHomeDir(adapter);
+    return {
+        scope: 'global',
+        repoRoot: resolvedRepo,
+        configPath: project.configPath,
+        hooksSettingsPath: adapter === 'cursor'
+            ? path.join(globalAgent, 'hooks.json')
+            : adapter === 'claude'
+                ? path.join(globalAgent, 'settings.json')
+                : path.join(globalAgent, 'config.toml'),
+        hooksDir: path.join(globalAgent, 'hooks'),
+        runtimeDir: path.join(globalAgent, 'belay', 'runtime'),
+        repoLocalStateDir: project.repoLocalStateDir,
+        skillsDir: path.join(globalAgent, 'skills', 'belay'),
+        commandsDir: adapter === 'cursor' ? path.join(globalAgent, 'commands') : undefined,
+    };
+}
+export function resolveInstallScope(options, persisted, fallback = 'project') {
+    if (options.scope === 'managed') {
+        throw new Error('managed install scope is not implemented yet. Use --scope project (default) or --scope global.');
+    }
+    if (options.scope === 'global' || options.scope === 'project') {
+        return options.scope;
+    }
+    return persisted ?? fallback;
+}

package/dist/adapters/layouts/types.d.ts

@@ -0,0 +1,14 @@
+import type { BelayConfigV3 } from '../../core/config.js';
+export type AdapterName = 'cursor' | 'claude' | 'codex';
+export interface AdapterLayout {
+    name: AdapterName;
+    configPath(repoRoot: string): string;
+    hooksSettingsPath(repoRoot: string): string;
+    hooksDir(repoRoot: string): string;
+    runtimeDir(repoRoot: string): string;
+    repoLocalStateDir(repoRoot: string): string;
+    defaultAuditLogPath(repoRoot: string): string;
+    repoRootMarkers: string[];
+    runnerCommand(platform: NodeJS.Platform, repoRoot: string, hookName: string, ...args: string[]): string;
+    defaultConfig(repoRoot: string): Partial<BelayConfigV3>;
+}

package/dist/adapters/layouts/types.js

@@ -0,0 +1 @@
+export {};

package/dist/adapters/registry.d.ts

@@ -0,0 +1,4 @@
+import type { AdapterName } from './layouts/types.js';
+import type { BelayAdapter } from './types.js';
+export declare function getAdapter(name?: AdapterName): BelayAdapter;
+export declare function listAdapters(): AdapterName[];

package/dist/adapters/registry.js

@@ -0,0 +1,14 @@
+import { claudeAdapter } from './claude/adapter.js';
+import { codexAdapter } from './codex/adapter.js';
+import { cursorAdapter } from './cursor/adapter.js';
+const adapters = {
+    cursor: cursorAdapter,
+    claude: claudeAdapter,
+    codex: codexAdapter,
+};
+export function getAdapter(name = 'cursor') {
+    return adapters[name];
+}
+export function listAdapters() {
+    return Object.keys(adapters);
+}

package/dist/adapters/shared/gate-runtime.d.ts

@@ -0,0 +1,51 @@
+import type { GatedActionKind } from '../../core/gate-contract.js';
+import { type GatePermissionResponse, type GateVerdict } from '../../core/gate-contract.js';
+import { GateNormalizationError } from '../../core/gate-engine.js';
+import { type ApprovalStateFile, type BelayConfigV3 } from '../../core/index.js';
+import type { ClassifierOptions } from '../../core/types.js';
+import type { AdapterLayout } from '../layouts/types.js';
+export interface GateRuntimeContext {
+    layout: AdapterLayout;
+    repoRoot: string;
+    config: BelayConfigV3;
+    configPath: string;
+}
+export interface GateRuntimeDeps {
+    readConfig: (configPath: string) => Promise<unknown>;
+    appendAudit: (ctx: GateRuntimeContext, event: Record<string, unknown>) => Promise<void>;
+    loadApprovals: (ctx: GateRuntimeContext, fileName: 'pending-approvals.json' | 'approved-approvals.json') => Promise<{
+        filePath: string;
+        state: ApprovalStateFile;
+    }>;
+    writeApprovals: (filePath: string, state: ApprovalStateFile) => Promise<void>;
+}
+export declare function createDefaultGateRuntimeDeps(): GateRuntimeDeps;
+export declare function resolveGateConfig(ctx: Pick<GateRuntimeContext, 'layout' | 'repoRoot' | 'configPath'>, deps: GateRuntimeDeps): Promise<BelayConfigV3>;
+export declare function repoShellClassifierOptions(config: BelayConfigV3, repoRoot: string, layout: AdapterLayout, extras?: ClassifierOptions): ClassifierOptions;
+export declare function runtimeClassifierOptions(ctx: GateRuntimeContext, config: BelayConfigV3): ClassifierOptions;
+export declare function evaluateGatedAction(ctx: GateRuntimeContext, deps: GateRuntimeDeps, params: {
+    kind: GatedActionKind;
+    cwd: string;
+    command?: string;
+    payload?: Record<string, unknown>;
+    toolName?: string;
+}): Promise<GateVerdict>;
+/** R39: unmapped Codex tools ask via pending approval — not hard deny without approval path. */
+export declare function gateUnmappedToolVerdict(ctx: GateRuntimeContext, deps: GateRuntimeDeps, toolName: string, payload: Record<string, unknown>): Promise<GateVerdict>;
+export declare function processApprovalPrompt(ctx: GateRuntimeContext, deps: GateRuntimeDeps, prompt: string): Promise<{
+    continue: boolean;
+    user_message?: string;
+}>;
+export declare function gateVerdictToCursorResponse(verdict: GateVerdict): GatePermissionResponse;
+export declare function gateVerdictToClaudePreToolUseResponse(verdict: GateVerdict): Record<string, unknown>;
+export declare function gateVerdictToClaudeUserPromptResponse(verdict: {
+    continue: boolean;
+    user_message?: string;
+}): Record<string, unknown>;
+export declare function gateVerdictToCodexPreToolUseResponse(verdict: GateVerdict): Record<string, unknown>;
+export declare function gateVerdictToCodexUserPromptResponse(verdict: {
+    continue: boolean;
+    user_message?: string;
+}): Record<string, unknown>;
+export declare function appendObservedAudit(ctx: GateRuntimeContext, deps: GateRuntimeDeps, eventName: string, payload: Record<string, unknown>): Promise<void>;
+export { GateNormalizationError };