/**
 * ApprovalService -- REST API-friendly wrapper around ApprovalQueue.
 *
 * Bridges the gap between the HMAC-based ApprovalQueue and the
 * dashboard REST API. Handles token generation for authenticated
 * users so the dashboard doesn't need to know the HMAC secret.
 *
 * @connexum/ai-governance
 */
import { ApprovalQueue, type ApprovalRequest } from './approval-queue';
export interface ApprovalServiceConfig {
    /** The underlying ApprovalQueue instance */
    queue: ApprovalQueue;
    /** HMAC secret (same as ApprovalQueue's approvalSecret) */
    approvalSecret: string;
}
export interface DashboardApprovalDecision {
    requestId: string;
    status: 'approved' | 'denied';
    /** Authenticated user identity from session (e.g., 'user:john@acme.com') */
    userId: string;
    note?: string;
}
export declare class ApprovalService {
    private queue;
    private secret;
    constructor(config: ApprovalServiceConfig);
    /**
     * Submit a new approval request.
     */
    submit(agent: string, tool: string, inputSummary: string, reason: string): ApprovalRequest;
    /**
     * Resolve an approval from the dashboard.
     *
     * Generates the HMAC token internally so dashboard API handlers
     * don't need access to the approval secret.
     */
    resolveFromDashboard(decision: DashboardApprovalDecision): ApprovalRequest;
    /**
     * Resolve multiple approvals at once (bulk approve/deny from dashboard).
     */
    bulkResolve(decisions: DashboardApprovalDecision[]): {
        resolved: ApprovalRequest[];
        errors: Array<{
            requestId: string;
            error: string;
        }>;
    };
    /**
     * Get all pending approval requests.
     */
    getPending(): ApprovalRequest[];
    /**
     * Check the status of a specific request.
     */
    check(requestId: string): ApprovalRequest | null;
    /**
     * Get approval queue statistics.
     */
    getStats(): {
        total: number;
        pending: number;
        approved: number;
        denied: number;
        expired: number;
        escalated: number;
    };
    /**
     * Get all escalated requests.
     */
    getEscalated(): ApprovalRequest[];
    /**
     * Generate the HMAC approval token for a given request + status.
     * This is the bridge: the dashboard calls this service, which
     * has the secret, so the dashboard API handler doesn't need it.
     */
    private generateToken;
}
//# sourceMappingURL=approval-service.d.ts.map