agent-shim 0.0.0 → 7.1.0

package/dist/types/config/schema.d.ts

@@ -0,0 +1,746 @@
+import { z } from "zod";
+/**
+ * Every category a `~/.claude` entry can be classified into. `secret` is deliberately part of this list — it is a real classification the resolver acts on — but it is NOT part of `CategoryMapSchema`'s shape, because no configuration layer may ever toggle it. See OVERRIDABLE_CATEGORIES.
+ */
+export declare const CATEGORY_NAMES: readonly ["secret", "runtime", "history", "knowledge", "settings"];
+export type CategoryName = (typeof CATEGORY_NAMES)[number];
+/** The four categories a configuration layer is allowed to toggle. `secret` is absent by design. */
+export declare const OVERRIDABLE_CATEGORIES: readonly ["runtime", "history", "knowledge", "settings"];
+export type OverridableCategory = (typeof OVERRIDABLE_CATEGORIES)[number];
+/** True when `name` is one of the four categories a configuration layer may toggle. */
+export declare function isOverridableCategory(name: string): name is OverridableCategory;
+/** True when `name` is any of the five classification categories, including `secret`. */
+export declare function isCategoryName(name: string): name is CategoryName;
+/**
+ * The category toggle map's resolved shape — always exactly the four overridable categories, never the `all` pseudo-key `CategoryMapSchema` also accepts on input. Derived directly from `OverridableCategory` rather than `z.infer`red from a schema, since `CategoryMapSchema` itself carries a `.transform()` (whose inferred type follows the transform's *output*, so it can't be used to define its own output type without circularity) and a schema built solely to be `typeof`'d, never actually parsed with, would be dead weight at runtime for no benefit over a plain mapped type.
+ */
+export type CategoryMap = Partial<Record<OverridableCategory, boolean>>;
+/**
+ * Expands the `all` pseudo-category key, dropping `all` itself from the result. `all: true` opens every category meant to be shared across identities, which is every overridable category except `runtime`: `runtime` holds live per-process and per-machine state (daemon locks and auth status, PIDs, IDE and shell snapshots) that must never be pooled across running identities, so it opens only when named explicitly. `all: false` closes every overridable category, `runtime` included, so it also closes a `runtime` an earlier layer opened. An explicit named category always wins over the `all` expansion regardless of where it appears relative to `all` in the input: `{ all: true, runtime: true }` opens `runtime` too, and `{ all: true, history: false }` means "share everything except history", not "history is false, then immediately overwritten back to true".
+ *
+ * This is the one shared implementation `CategoryMapSchema`'s own transform, `launcher/cliOverride.ts`'s `--category`/`AGENT_SHIM_CATEGORY_OVERRIDE` handling, and `configProfiles.ts`'s `agent-shim profile set --category` all call, so `all` means the same thing regardless of which of those three input paths it arrived through.
+ */
+export declare function expandAllCategoryKey(pairs: Readonly<Record<string, boolean>>): Record<string, boolean>;
+/**
+ * The category toggle map as written by hand: the four overridable categories, plus `all` as shorthand for "every shareable category at once" (expanded by `expandAllCategoryKey` above). `secret` is omitted from the shape entirely, so `{ "categories": { "secret": true } }` is rejected at parse time rather than relying solely on the resolver's runtime floor check. The closed shape is also what lets the published JSON Schema offer real key-name autocomplete, which an open record type cannot.
+ */
+export declare const CategoryMapSchema: z.ZodPipe<z.ZodObject<{
+    all: z.ZodOptional<z.ZodBoolean>;
+    runtime: z.ZodOptional<z.ZodBoolean>;
+    history: z.ZodOptional<z.ZodBoolean>;
+    knowledge: z.ZodOptional<z.ZodBoolean>;
+    settings: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodTransform<Partial<Record<"runtime" | "history" | "knowledge" | "settings", boolean>>, {
+    all?: boolean | undefined;
+    runtime?: boolean | undefined;
+    history?: boolean | undefined;
+    knowledge?: boolean | undefined;
+    settings?: boolean | undefined;
+}>>;
+/** A duration literal: a positive integer count followed by a unit. Used by `newerThan`/`olderThan`. */
+export declare const DURATION_RE: RegExp;
+/**
+ * A conditional guard on an entries value or a whole directory rule. Every field present within one `when` object must hold (AND logic). An empty object is vacuously true — `agent-shim check` warns about it, it is never an error.
+ */
+export declare const WhenSchema: z.ZodObject<{
+    newerThan: z.ZodOptional<z.ZodString>;
+    olderThan: z.ZodOptional<z.ZodString>;
+    maxSizeBytes: z.ZodOptional<z.ZodInt>;
+    branch: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strict>;
+export type WhenCondition = z.infer<typeof WhenSchema>;
+/** An entries value: a flat boolean, or a boolean guarded by a `when` condition. */
+export declare const EntryValueSchema: z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+    value: z.ZodBoolean;
+    when: z.ZodObject<{
+        newerThan: z.ZodOptional<z.ZodString>;
+        olderThan: z.ZodOptional<z.ZodString>;
+        maxSizeBytes: z.ZodOptional<z.ZodInt>;
+        branch: z.ZodOptional<z.ZodString>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>;
+}, z.core.$strict>]>;
+export type EntryValue = z.infer<typeof EntryValueSchema>;
+/**
+ * Every entries key is `<category>/<real-relative-path>`, always — never a bare path. The prefix is what makes a key unambiguous when two categories happen to share a top-level name, and it is what lets the resolver cross-check a key's *declared* category against the *real* classification of the path it names, catching an entry that tries to launder a secret path through a `runtime/...` key.
+ */
+export declare const ENTRY_KEY_RE: RegExp;
+export declare const EntriesSchema: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+    value: z.ZodBoolean;
+    when: z.ZodObject<{
+        newerThan: z.ZodOptional<z.ZodString>;
+        olderThan: z.ZodOptional<z.ZodString>;
+        maxSizeBytes: z.ZodOptional<z.ZodInt>;
+        branch: z.ZodOptional<z.ZodString>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>;
+}, z.core.$strict>]>>;
+export type Entries = z.infer<typeof EntriesSchema>;
+/** Launch flags, resolved through the same cascade as categories and entries. */
+declare const LaunchSchema: z.ZodObject<{
+    skipPermissions: z.ZodOptional<z.ZodBoolean>;
+    remoteControl: z.ZodOptional<z.ZodBoolean>;
+    provider: z.ZodOptional<z.ZodString>;
+    headroom: z.ZodOptional<z.ZodBoolean>;
+    trackUsage: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type LaunchFlags = z.infer<typeof LaunchSchema>;
+/**
+ * Where a resolved credential lands in the child's environment. `bearer` exports it as `ANTHROPIC_AUTH_TOKEN` (what relays and aggregators expect, and the default), `apiKey` as `ANTHROPIC_API_KEY` (sent as `x-api-key`, what a regular Anthropic API key needs), and `oauthToken` as `CLAUDE_CODE_OAUTH_TOKEN` (a long-lived subscription token from `claude setup-token`). `oauthToken` authenticates a login, not an endpoint, so only an identity may use it; see `PROVIDER_CREDENTIAL_TARGETS`.
+ */
+export declare const CREDENTIAL_TARGETS: readonly ["bearer", "apiKey", "oauthToken"];
+export type CredentialTarget = (typeof CREDENTIAL_TARGETS)[number];
+/** The targets a provider's credential may use: every target except `oauthToken`, which only an identity can carry. */
+export declare const PROVIDER_CREDENTIAL_TARGETS: readonly ["bearer", "apiKey"];
+/** The environment variable each credential target exports the token as. These are also the variables no provider `env` block may set, since agent-shim sets and clears them itself. */
+export declare const CREDENTIAL_TARGET_VARS: {
+    readonly bearer: "ANTHROPIC_AUTH_TOKEN";
+    readonly apiKey: "ANTHROPIC_API_KEY";
+    readonly oauthToken: "CLAUDE_CODE_OAUTH_TOKEN";
+};
+export type CredentialTargetVar = (typeof CREDENTIAL_TARGET_VARS)[CredentialTarget];
+/**
+ * One place a credential can come from. Each kind is an object with exactly one kind-naming key, so the kinds are told apart by which key is present rather than by a separate tag, and `strictObject` rejects an object naming two.
+ *
+ * - `env`: the NAME of an environment variable in the launching shell, never its value.
+ * - `file`: an absolute or `~`-rooted path to a file holding the token, which must not be readable or writable by group or others (mode 600 or stricter).
+ * - `command`: an argv run at launch whose trimmed stdout is the token, so the credential exists only in the child.
+ * - `op`: a 1Password secret reference, run as `op read <ref>`. A 1Password service account needs nothing here: `OP_SERVICE_ACCOUNT_TOKEN` in the launching environment is inherited by the command.
+ * - `keychain`: a macOS Keychain generic password, run as `security find-generic-password -s <service> [-a <account>] -w`.
+ * - `literal`: a fixed value written in the file itself. It is NOT a place for a secret: it exists for local proxies that accept any placeholder token (a codex-translation proxy, say) and so have no real credential to keep out of committed config. Anything with a real credential must use one of the other kinds.
+ */
+export declare const CredentialSourceSchema: z.ZodUnion<readonly [z.ZodObject<{
+    env: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    file: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    interactive: z.ZodOptional<z.ZodBoolean>;
+    timeoutMs: z.ZodOptional<z.ZodInt>;
+    command: z.ZodTuple<[z.ZodString], z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    interactive: z.ZodOptional<z.ZodBoolean>;
+    timeoutMs: z.ZodOptional<z.ZodInt>;
+    op: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    interactive: z.ZodOptional<z.ZodBoolean>;
+    timeoutMs: z.ZodOptional<z.ZodInt>;
+    keychain: z.ZodObject<{
+        service: z.ZodString;
+        account: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    literal: z.ZodString;
+}, z.core.$strict>]>;
+export type CredentialSource = z.infer<typeof CredentialSourceSchema>;
+/** Where a cached credential is kept: the macOS login Keychain, or a mode-0600 file under the agent-shim home. */
+export declare const CREDENTIAL_CACHE_STORES: readonly ["keychain", "file"];
+export type CredentialCacheStore = (typeof CREDENTIAL_CACHE_STORES)[number];
+/**
+ * An optional cache on a credential block: the resolved token is kept for `ttl` (a whole number followed by `s`, `m`, `h` or `d`, for example `12h`) so a launch does not re-run a source that needs a person, such as a desktop-unlocked `op`. With no `ttl` the cached token never expires and is replaced only by `credential warm` or removed by `credential forget`. `store` defaults to the Keychain on macOS and a file elsewhere. A block with no `cache` stores nothing and fetches on every launch.
+ */
+export declare const CredentialCacheSchema: z.ZodObject<{
+    ttl: z.ZodOptional<z.ZodString>;
+    store: z.ZodOptional<z.ZodEnum<{
+        file: "file";
+        keychain: "keychain";
+    }>>;
+}, z.core.$strict>;
+export type CredentialCache = z.infer<typeof CredentialCacheSchema>;
+/**
+ * The credential block providers and identities share: an ordered list of sources, tried in turn until one yields a non-empty token, and the target that token is exported as. `target` defaults to `bearer`.
+ */
+export declare const CredentialSchema: z.ZodObject<{
+    sources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        env: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        file: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        interactive: z.ZodOptional<z.ZodBoolean>;
+        timeoutMs: z.ZodOptional<z.ZodInt>;
+        command: z.ZodTuple<[z.ZodString], z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        interactive: z.ZodOptional<z.ZodBoolean>;
+        timeoutMs: z.ZodOptional<z.ZodInt>;
+        op: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        interactive: z.ZodOptional<z.ZodBoolean>;
+        timeoutMs: z.ZodOptional<z.ZodInt>;
+        keychain: z.ZodObject<{
+            service: z.ZodString;
+            account: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        literal: z.ZodString;
+    }, z.core.$strict>]>>;
+    target: z.ZodOptional<z.ZodEnum<{
+        bearer: "bearer";
+        apiKey: "apiKey";
+        oauthToken: "oauthToken";
+    }>>;
+    cache: z.ZodOptional<z.ZodObject<{
+        ttl: z.ZodOptional<z.ZodString>;
+        store: z.ZodOptional<z.ZodEnum<{
+            file: "file";
+            keychain: "keychain";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Credential = z.infer<typeof CredentialSchema>;
+/** The kinds of provider: `http` is an Anthropic Messages endpoint at a fixed `baseUrl` (the default when `kind` is absent), and `codex` is ChatGPT's Codex backend reached through agent-shim's own supervised translation daemon. */
+export declare const PROVIDER_KINDS: readonly ["http", "codex"];
+/**
+ * The Claude model tiers the codex translator maps, in the order they are matched: the first tier whose name is a substring of the requested model (case-insensitive) decides the codex model. `fable` comes before `opus` because a fable model name is the most specific.
+ */
+export declare const CODEX_TIERS: readonly ["fable", "opus", "sonnet", "haiku"];
+export type CodexTier = (typeof CODEX_TIERS)[number];
+/** The reasoning efforts the codex backend accepts, plus `none`, which omits the reasoning block from the upstream request entirely. */
+export declare const CODEX_EFFORTS: readonly ["none", "low", "medium", "high"];
+export type CodexEffort = (typeof CODEX_EFFORTS)[number];
+/** The codex model every tier maps to when neither its own tier entry nor `defaultModel` says otherwise. */
+export declare const CODEX_DEFAULT_MODEL = "gpt-5.6-sol";
+/** The shipped tier mapping: the flagship model for fable and opus, the mid-size one for sonnet, the small one for haiku. */
+export declare const CODEX_DEFAULT_TIER_MODELS: Readonly<Record<CodexTier, string>>;
+/** The shipped reasoning effort for a request that does not ask for one the backend accepts. */
+export declare const CODEX_DEFAULT_EFFORT: CodexEffort;
+/**
+ * How a codex provider translates Claude Code's requests. Every field is optional and defaults to the shipped mapping (`CODEX_DEFAULT_MODEL`, `CODEX_DEFAULT_TIER_MODELS`, `CODEX_DEFAULT_EFFORT`), so an absent block means the stock behaviour. A requested model that already names a codex model (`gpt-...`) passes through untouched whatever this says.
+ */
+export declare const CodexProviderConfigSchema: z.ZodObject<{
+    defaultModel: z.ZodOptional<z.ZodString>;
+    models: z.ZodOptional<z.ZodObject<{
+        fable: z.ZodOptional<z.ZodString>;
+        opus: z.ZodOptional<z.ZodString>;
+        sonnet: z.ZodOptional<z.ZodString>;
+        haiku: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    effort: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>>;
+}, z.core.$strict>;
+export type CodexProviderConfig = z.infer<typeof CodexProviderConfigSchema>;
+/** A `codex` provider: see `ProviderSchema`. */
+declare const CodexProviderSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<"codex">;
+    displayName: z.ZodString;
+    credential: z.ZodObject<{
+        sources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            file: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            command: z.ZodTuple<[z.ZodString], z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            op: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            keychain: z.ZodObject<{
+                service: z.ZodString;
+                account: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            literal: z.ZodString;
+        }, z.core.$strict>]>>;
+        cache: z.ZodOptional<z.ZodObject<{
+            ttl: z.ZodOptional<z.ZodString>;
+            store: z.ZodOptional<z.ZodEnum<{
+                file: "file";
+                keychain: "keychain";
+            }>>;
+        }, z.core.$strict>>;
+        target: z.ZodOptional<z.ZodEnum<{
+            bearer: "bearer";
+            apiKey: "apiKey";
+        }>>;
+    }, z.core.$strict>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    codex: z.ZodOptional<z.ZodObject<{
+        defaultModel: z.ZodOptional<z.ZodString>;
+        models: z.ZodOptional<z.ZodObject<{
+            fable: z.ZodOptional<z.ZodString>;
+            opus: z.ZodOptional<z.ZodString>;
+            sonnet: z.ZodOptional<z.ZodString>;
+            haiku: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CodexProvider = z.infer<typeof CodexProviderSchema>;
+/** Either kind of provider; see `HttpProviderSchema` for the shared fields. */
+export declare const ProviderSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    kind: z.ZodOptional<z.ZodLiteral<"http">>;
+    displayName: z.ZodString;
+    baseUrl: z.ZodURL;
+    credential: z.ZodObject<{
+        sources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            file: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            command: z.ZodTuple<[z.ZodString], z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            op: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            keychain: z.ZodObject<{
+                service: z.ZodString;
+                account: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            literal: z.ZodString;
+        }, z.core.$strict>]>>;
+        cache: z.ZodOptional<z.ZodObject<{
+            ttl: z.ZodOptional<z.ZodString>;
+            store: z.ZodOptional<z.ZodEnum<{
+                file: "file";
+                keychain: "keychain";
+            }>>;
+        }, z.core.$strict>>;
+        target: z.ZodOptional<z.ZodEnum<{
+            bearer: "bearer";
+            apiKey: "apiKey";
+        }>>;
+    }, z.core.$strict>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strict>, z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<"codex">;
+    displayName: z.ZodString;
+    credential: z.ZodObject<{
+        sources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            file: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            command: z.ZodTuple<[z.ZodString], z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            op: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            keychain: z.ZodObject<{
+                service: z.ZodString;
+                account: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            literal: z.ZodString;
+        }, z.core.$strict>]>>;
+        cache: z.ZodOptional<z.ZodObject<{
+            ttl: z.ZodOptional<z.ZodString>;
+            store: z.ZodOptional<z.ZodEnum<{
+                file: "file";
+                keychain: "keychain";
+            }>>;
+        }, z.core.$strict>>;
+        target: z.ZodOptional<z.ZodEnum<{
+            bearer: "bearer";
+            apiKey: "apiKey";
+        }>>;
+    }, z.core.$strict>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    codex: z.ZodOptional<z.ZodObject<{
+        defaultModel: z.ZodOptional<z.ZodString>;
+        models: z.ZodOptional<z.ZodObject<{
+            fable: z.ZodOptional<z.ZodString>;
+            opus: z.ZodOptional<z.ZodString>;
+            sonnet: z.ZodOptional<z.ZodString>;
+            haiku: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "kind">;
+export type Provider = z.infer<typeof ProviderSchema>;
+/** True when `provider` is a codex provider. `kind` is the tag, since a codex provider's own distinguishing block is optional. */
+export declare function isCodexProvider(provider: Provider): provider is CodexProvider;
+/**
+ * A named, reusable configuration profile at `~/.agent-shim/config-profiles/<name>.json`.
+ *
+ * `extends` is a flat array of other profiles' *names*, deliberately not a self-referential `z.lazy()` schema: nothing in this shape points back at a profile object, so each file validates in isolation and the extends graph is walked at resolve time. That also means Zod cannot detect a circular `extends` definition — the walker in `src/resolve/extends.ts` carries its own cycle guard.
+ */
+export declare const ConfigProfileSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+        all: z.ZodOptional<z.ZodBoolean>;
+        runtime: z.ZodOptional<z.ZodBoolean>;
+        history: z.ZodOptional<z.ZodBoolean>;
+        knowledge: z.ZodOptional<z.ZodBoolean>;
+        settings: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodTransform<Partial<Record<"runtime" | "history" | "knowledge" | "settings", boolean>>, {
+        all?: boolean | undefined;
+        runtime?: boolean | undefined;
+        history?: boolean | undefined;
+        knowledge?: boolean | undefined;
+        settings?: boolean | undefined;
+    }>>>;
+    entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        value: z.ZodBoolean;
+        when: z.ZodObject<{
+            newerThan: z.ZodOptional<z.ZodString>;
+            olderThan: z.ZodOptional<z.ZodString>;
+            maxSizeBytes: z.ZodOptional<z.ZodInt>;
+            branch: z.ZodOptional<z.ZodString>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>>;
+    launch: z.ZodOptional<z.ZodObject<{
+        skipPermissions: z.ZodOptional<z.ZodBoolean>;
+        remoteControl: z.ZodOptional<z.ZodBoolean>;
+        provider: z.ZodOptional<z.ZodString>;
+        headroom: z.ZodOptional<z.ZodBoolean>;
+        trackUsage: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ConfigProfile = z.infer<typeof ConfigProfileSchema>;
+/** The prefix that turns a pool name into an identity selector. `:` is outside an identity name's character set, so a selector can never be mistaken for an identity. */
+export declare const POOL_SELECTOR_PREFIX = "pool:";
+/** A pool's own name: the identity alphabet minus `@`, since a pool is never an email address. */
+export declare const PoolNameSchema: z.ZodString;
+/** A named, explicit set of identities to choose among at launch. Never implicit: a pool lists its members, so an identity that bills a client is only ever picked when someone put it there. */
+declare const PoolSchema: z.ZodObject<{
+    identities: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type Pool = z.infer<typeof PoolSchema>;
+/** One directory rule in `~/.agent-shim/directory-rules.json`, scoped to an explicit absolute (or `~`-rooted) path. */
+export declare const DirectoryRuleSchema: z.ZodObject<{
+    entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        value: z.ZodBoolean;
+        when: z.ZodObject<{
+            newerThan: z.ZodOptional<z.ZodString>;
+            olderThan: z.ZodOptional<z.ZodString>;
+            maxSizeBytes: z.ZodOptional<z.ZodInt>;
+            branch: z.ZodOptional<z.ZodString>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>>;
+    $schema: z.ZodOptional<z.ZodString>;
+    extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+        all: z.ZodOptional<z.ZodBoolean>;
+        runtime: z.ZodOptional<z.ZodBoolean>;
+        history: z.ZodOptional<z.ZodBoolean>;
+        knowledge: z.ZodOptional<z.ZodBoolean>;
+        settings: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodTransform<Partial<Record<"runtime" | "history" | "knowledge" | "settings", boolean>>, {
+        all?: boolean | undefined;
+        runtime?: boolean | undefined;
+        history?: boolean | undefined;
+        knowledge?: boolean | undefined;
+        settings?: boolean | undefined;
+    }>>>;
+    launch: z.ZodOptional<z.ZodObject<{
+        skipPermissions: z.ZodOptional<z.ZodBoolean>;
+        remoteControl: z.ZodOptional<z.ZodBoolean>;
+        provider: z.ZodOptional<z.ZodString>;
+        headroom: z.ZodOptional<z.ZodBoolean>;
+        trackUsage: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    path: z.ZodString;
+    configProfile: z.ZodOptional<z.ZodString>;
+    identity: z.ZodOptional<z.ZodString>;
+    when: z.ZodOptional<z.ZodObject<{
+        newerThan: z.ZodOptional<z.ZodString>;
+        olderThan: z.ZodOptional<z.ZodString>;
+        maxSizeBytes: z.ZodOptional<z.ZodInt>;
+        branch: z.ZodOptional<z.ZodString>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DirectoryRule = z.infer<typeof DirectoryRuleSchema>;
+/** The `~/.agent-shim/directory-rules.json` file. */
+export declare const DirectoryRulesSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    rules: z.ZodArray<z.ZodObject<{
+        entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+            value: z.ZodBoolean;
+            when: z.ZodObject<{
+                newerThan: z.ZodOptional<z.ZodString>;
+                olderThan: z.ZodOptional<z.ZodString>;
+                maxSizeBytes: z.ZodOptional<z.ZodInt>;
+                branch: z.ZodOptional<z.ZodString>;
+                env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>]>>>;
+        $schema: z.ZodOptional<z.ZodString>;
+        extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+            all: z.ZodOptional<z.ZodBoolean>;
+            runtime: z.ZodOptional<z.ZodBoolean>;
+            history: z.ZodOptional<z.ZodBoolean>;
+            knowledge: z.ZodOptional<z.ZodBoolean>;
+            settings: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodTransform<Partial<Record<"runtime" | "history" | "knowledge" | "settings", boolean>>, {
+            all?: boolean | undefined;
+            runtime?: boolean | undefined;
+            history?: boolean | undefined;
+            knowledge?: boolean | undefined;
+            settings?: boolean | undefined;
+        }>>>;
+        launch: z.ZodOptional<z.ZodObject<{
+            skipPermissions: z.ZodOptional<z.ZodBoolean>;
+            remoteControl: z.ZodOptional<z.ZodBoolean>;
+            provider: z.ZodOptional<z.ZodString>;
+            headroom: z.ZodOptional<z.ZodBoolean>;
+            trackUsage: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        path: z.ZodString;
+        configProfile: z.ZodOptional<z.ZodString>;
+        identity: z.ZodOptional<z.ZodString>;
+        when: z.ZodOptional<z.ZodObject<{
+            newerThan: z.ZodOptional<z.ZodString>;
+            olderThan: z.ZodOptional<z.ZodString>;
+            maxSizeBytes: z.ZodOptional<z.ZodInt>;
+            branch: z.ZodOptional<z.ZodString>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DirectoryRules = z.infer<typeof DirectoryRulesSchema>;
+/**
+ * A committed `.agent-shim.json` (or its gitignored `.agent-shim.local.json` sibling). Structurally a directory rule without the `path` field: its scope is implicit — wherever the file lives, and everything below it — which is exactly what makes it portable across clone locations.
+ */
+export declare const PortableConfigSchema: z.ZodObject<{
+    entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        value: z.ZodBoolean;
+        when: z.ZodObject<{
+            newerThan: z.ZodOptional<z.ZodString>;
+            olderThan: z.ZodOptional<z.ZodString>;
+            maxSizeBytes: z.ZodOptional<z.ZodInt>;
+            branch: z.ZodOptional<z.ZodString>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>>;
+    $schema: z.ZodOptional<z.ZodString>;
+    extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+        all: z.ZodOptional<z.ZodBoolean>;
+        runtime: z.ZodOptional<z.ZodBoolean>;
+        history: z.ZodOptional<z.ZodBoolean>;
+        knowledge: z.ZodOptional<z.ZodBoolean>;
+        settings: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodTransform<Partial<Record<"runtime" | "history" | "knowledge" | "settings", boolean>>, {
+        all?: boolean | undefined;
+        runtime?: boolean | undefined;
+        history?: boolean | undefined;
+        knowledge?: boolean | undefined;
+        settings?: boolean | undefined;
+    }>>>;
+    launch: z.ZodOptional<z.ZodObject<{
+        skipPermissions: z.ZodOptional<z.ZodBoolean>;
+        remoteControl: z.ZodOptional<z.ZodBoolean>;
+        provider: z.ZodOptional<z.ZodString>;
+        headroom: z.ZodOptional<z.ZodBoolean>;
+        trackUsage: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    configProfile: z.ZodOptional<z.ZodString>;
+    identity: z.ZodOptional<z.ZodString>;
+    when: z.ZodOptional<z.ZodObject<{
+        newerThan: z.ZodOptional<z.ZodString>;
+        olderThan: z.ZodOptional<z.ZodString>;
+        maxSizeBytes: z.ZodOptional<z.ZodInt>;
+        branch: z.ZodOptional<z.ZodString>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type PortableConfig = z.infer<typeof PortableConfigSchema>;
+declare const HeadroomGlobalConfigSchema: z.ZodObject<{
+    source: z.ZodOptional<z.ZodString>;
+    idleShutdownMinutes: z.ZodOptional<z.ZodNumber>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        cache: "cache";
+        token: "token";
+    }>>;
+    targetRatio: z.ZodOptional<z.ZodNumber>;
+    ccr: z.ZodOptional<z.ZodEnum<{
+        default: "default";
+        none: "none";
+        lossless: "lossless";
+    }>>;
+    rolloutChannel: z.ZodOptional<z.ZodEnum<{
+        beta: "beta";
+        canary: "canary";
+        dev: "dev";
+    }>>;
+    interceptToolResults: z.ZodOptional<z.ZodBoolean>;
+    readMaturation: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type HeadroomGlobalConfig = z.infer<typeof HeadroomGlobalConfigSchema>;
+/**
+ * The default `headroom.source` install spec: the ExaDev headroom repository, with the `proxy` extra that provides the `headroom proxy` entry point. Pinned to a full commit SHA (the fork's `exadev-per-session-savings-1` tag), because a branch name can be rebased or deleted and would change or break every fresh install; bump it deliberately when the fork's per-session savings work changes. Kept here rather than in the supervisor because it is the schema's own documented default, referenced by `HeadroomGlobalConfigSchema`'s field docs.
+ */
+export declare const HEADROOM_DEFAULT_SOURCE = "headroom-ai[proxy] @ git+https://github.com/ExaDev/headroom@ecd1c351fcfed97499721e86852e148436ff2ee6";
+/**
+ * The default `headroom.idleShutdownMinutes`: long enough that back-to-back sessions keep the daemon warm through a coffee break, short enough that an abandoned daemon frees its memory the same working day rather than squatting until reboot.
+ */
+export declare const HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
+/**
+ * The default `frontdoor.idleShutdownMinutes`, the same trade-off as headroom's: warm through a break, gone the same working day once abandoned.
+ */
+export declare const FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
+/** The user-global `~/.agent-shim/config.json`. */
+export declare const GlobalConfigSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    defaultConfigProfile: z.ZodOptional<z.ZodString>;
+    walkUpLimit: z.ZodOptional<z.ZodString>;
+    categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+        all: z.ZodOptional<z.ZodBoolean>;
+        runtime: z.ZodOptional<z.ZodBoolean>;
+        history: z.ZodOptional<z.ZodBoolean>;
+        knowledge: z.ZodOptional<z.ZodBoolean>;
+        settings: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodTransform<Partial<Record<"runtime" | "history" | "knowledge" | "settings", boolean>>, {
+        all?: boolean | undefined;
+        runtime?: boolean | undefined;
+        history?: boolean | undefined;
+        knowledge?: boolean | undefined;
+        settings?: boolean | undefined;
+    }>>>;
+    entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        value: z.ZodBoolean;
+        when: z.ZodObject<{
+            newerThan: z.ZodOptional<z.ZodString>;
+            olderThan: z.ZodOptional<z.ZodString>;
+            maxSizeBytes: z.ZodOptional<z.ZodInt>;
+            branch: z.ZodOptional<z.ZodString>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>>;
+    launch: z.ZodOptional<z.ZodObject<{
+        skipPermissions: z.ZodOptional<z.ZodBoolean>;
+        remoteControl: z.ZodOptional<z.ZodBoolean>;
+        provider: z.ZodOptional<z.ZodString>;
+        headroom: z.ZodOptional<z.ZodBoolean>;
+        trackUsage: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    headroom: z.ZodOptional<z.ZodObject<{
+        source: z.ZodOptional<z.ZodString>;
+        idleShutdownMinutes: z.ZodOptional<z.ZodNumber>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            cache: "cache";
+            token: "token";
+        }>>;
+        targetRatio: z.ZodOptional<z.ZodNumber>;
+        ccr: z.ZodOptional<z.ZodEnum<{
+            default: "default";
+            none: "none";
+            lossless: "lossless";
+        }>>;
+        rolloutChannel: z.ZodOptional<z.ZodEnum<{
+            beta: "beta";
+            canary: "canary";
+            dev: "dev";
+        }>>;
+        interceptToolResults: z.ZodOptional<z.ZodBoolean>;
+        readMaturation: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    frontdoor: z.ZodOptional<z.ZodObject<{
+        idleShutdownMinutes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    pools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        identities: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type GlobalConfig = z.infer<typeof GlobalConfigSchema>;
+/**
+ * An identity's own `identity.json`. `credential`, when present, authenticates the identity from a token instead of (or ahead of) its stored login: the launcher resolves it and exports it as its target (typically `oauthToken`, a `claude setup-token` token) in the child's environment only. Without it the identity uses the login stored in its own directory.
+ */
+export declare const IdentitySchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    defaultConfigProfile: z.ZodOptional<z.ZodString>;
+    allowAmbientCredential: z.ZodDefault<z.ZodBoolean>;
+    credential: z.ZodOptional<z.ZodObject<{
+        sources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            file: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            command: z.ZodTuple<[z.ZodString], z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            op: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            interactive: z.ZodOptional<z.ZodBoolean>;
+            timeoutMs: z.ZodOptional<z.ZodInt>;
+            keychain: z.ZodObject<{
+                service: z.ZodString;
+                account: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            literal: z.ZodString;
+        }, z.core.$strict>]>>;
+        target: z.ZodOptional<z.ZodEnum<{
+            bearer: "bearer";
+            apiKey: "apiKey";
+            oauthToken: "oauthToken";
+        }>>;
+        cache: z.ZodOptional<z.ZodObject<{
+            ttl: z.ZodOptional<z.ZodString>;
+            store: z.ZodOptional<z.ZodEnum<{
+                file: "file";
+                keychain: "keychain";
+            }>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Identity = z.infer<typeof IdentitySchema>;
+/**
+ * The OTHER "categories" concept, and a different shape from CategoryMapSchema entirely: this maps each category name to the list of literal names and globs whose top-level `~/.claude` entries belong to it. CategoryMapSchema says *whether* a category is shared; this says *which entries are in* a category. Do not conflate them.
+ */
+export declare const CategoryClassificationSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    secret: z.ZodArray<z.ZodString>;
+    runtime: z.ZodArray<z.ZodString>;
+    history: z.ZodArray<z.ZodString>;
+    knowledge: z.ZodArray<z.ZodString>;
+    settings: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type CategoryClassification = z.infer<typeof CategoryClassificationSchema>;
+/** The gitignored `~/.agent-shim/categories.local.json` overlay: any subset of the classification lists, answering "what category is this new entry?" without editing the shipped default map. */
+export declare const CategoryClassificationOverlaySchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    secret: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    runtime: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    history: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    knowledge: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    settings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type CategoryClassificationOverlay = z.infer<typeof CategoryClassificationOverlaySchema>;
+/**
+ * Whether a category is shared when no configuration layer says otherwise. This is the final fallback beneath every layer of the cascade, matching the README's category table: every identity shares the same `knowledge`, `settings`, and `history` out of the box — only `runtime` (live per-process/machine state that cannot be meaningfully shared) stays closed by default, and `secret` can never be shared at all. Identities differ in credentials, not in the data they see.
+ */
+export declare const SHIPPED_CATEGORY_DEFAULTS: Readonly<Record<CategoryName, boolean>>;
+export {};