/**
 * Approval gate manager for CANT workflow execution.
 *
 * Manages the lifecycle of approval tokens: generation, validation,
 * approval, rejection, and expiration. Tokens follow the state machine
 * defined in CANT-DSL-SPEC.md Section 8.2.
 *
 * State transitions are atomic (CAS): only `pending -> approved`,
 * `pending -> rejected`, and `pending -> expired` are permitted.
 *
 * @see docs/specs/CANT-DSL-SPEC.md Section 8 (Approval Token Protocol)
 */
import type { ApprovalToken, TokenValidation } from './types.js';
/**
 * Manages approval tokens for CANT workflow gates.
 *
 * Tokens are stored in-memory per instance. In production, these are
 * persisted via the session's `approvalTokensJson` column in tasks.db.
 */
export declare class ApprovalManager {
    /** In-memory token store keyed by token UUID. */
    private tokens;
    /**
     * Generates a new approval token for a workflow gate.
     *
     * @param sessionId - The session that owns this token.
     * @param workflowName - The workflow containing the approval gate.
     * @param gateName - The label of the specific approval gate.
     * @param message - The message to display to the approver.
     * @param workflowHash - SHA-256 hash of the workflow definition.
     * @param requestedBy - The agent/workflow requesting approval.
     * @param expiresInMs - Token lifetime in milliseconds (default: 24h).
     * @returns The generated approval token.
     */
    generateToken(sessionId: string, workflowName: string, gateName: string, message: string, workflowHash: string, requestedBy: string, expiresInMs?: number): ApprovalToken;
    /**
     * Validates an approval token against the current execution context.
     *
     * Checks: (a) token exists, (b) sessionId matches, (c) status is pending,
     * (d) not expired, (e) workflowHash matches current workflow.
     *
     * @param tokenId - The token UUID to validate.
     * @param currentSessionId - The current session to validate against.
     * @param currentWorkflowHash - The current workflow hash for TOCTOU check.
     * @returns Validation result with reason if invalid.
     */
    validateToken(tokenId: string, currentSessionId: string, currentWorkflowHash: string): TokenValidation;
    /**
     * Approves a pending token.
     *
     * Performs an atomic CAS transition: `pending -> approved`. If the token
     * is not in `pending` state, the operation is a no-op and returns false.
     *
     * @param tokenId - The token UUID to approve.
     * @param approvedBy - The identifier of the approving actor.
     * @returns `true` if the transition succeeded, `false` if CAS failed.
     */
    approveToken(tokenId: string, approvedBy: string): boolean;
    /**
     * Rejects a pending token.
     *
     * Performs an atomic CAS transition: `pending -> rejected`.
     *
     * @param tokenId - The token UUID to reject.
     * @returns `true` if the transition succeeded, `false` if CAS failed.
     */
    rejectToken(tokenId: string): boolean;
    /**
     * Expires a pending token.
     *
     * Performs an atomic CAS transition: `pending -> expired`.
     *
     * @param tokenId - The token UUID to expire.
     * @returns `true` if the transition succeeded, `false` if CAS failed.
     */
    expireToken(tokenId: string): boolean;
    /**
     * Retrieves a token by its UUID.
     *
     * @param tokenId - The token UUID to look up.
     * @returns The token if found, otherwise undefined.
     */
    getToken(tokenId: string): ApprovalToken | undefined;
    /**
     * Lists all tokens for a given session.
     *
     * @param sessionId - The session to filter by.
     * @returns Array of tokens belonging to the session.
     */
    getTokensForSession(sessionId: string): ApprovalToken[];
    /**
     * Computes a SHA-256 hash of a workflow definition string.
     *
     * Used for TOCTOU protection: the hash at token creation time is compared
     * against the hash at approval time.
     *
     * @param workflowText - The raw workflow definition text.
     * @returns Hex-encoded SHA-256 hash.
     */
    static computeWorkflowHash(workflowText: string): string;
    /**
     * Atomically transitions a token from `pending` to the target status.
     *
     * @param tokenId - The token UUID.
     * @param targetStatus - The desired new status.
     * @returns `true` if the CAS transition succeeded.
     */
    private transitionStatus;
}
//# sourceMappingURL=approval.d.ts.map