import { type Kysely } from 'kysely';
import type { Database } from '../db/types.js';
/**
 * Trust entry representing a cross-repo trust relationship.
 */
interface TrustEntry {
    id: string;
    sourceRepo: string;
    sourceRoutingKey: string;
    targetRepo: string;
    targetRoutingKey: string;
    allowedEvents: string[] | null;
    enabled: boolean;
}
/**
 * TrustStore enforces bidirectional trust for cross-repo event delivery.
 *
 * Same-repo events (same routing key) are always trusted without a DB lookup.
 * Cross-repo events require an explicit enabled row in the cross_repo_trust table.
 * Glob-based event filtering is supported via the allowed_events column.
 */
export declare class TrustStore {
    private readonly db;
    constructor(db: Kysely<Database>);
    /**
     * Check whether event delivery from source to target is trusted.
     *
     * Same-routing-key events bypass the DB lookup entirely.
     * Cross-repo events require an enabled row with matching event name.
     */
    isTrusted(sourceRepo: string, sourceRoutingKey: string, targetRepo: string, targetRoutingKey: string, eventName: string): Promise<boolean>;
    /**
     * Add a trust relationship between source and target.
     * Uses ON CONFLICT DO NOTHING for idempotent inserts.
     * Returns the trust entry ID.
     */
    addTrust(source: {
        repo: string;
        routingKey: string;
    }, target: {
        repo: string;
        routingKey: string;
    }, allowedEvents?: string[]): Promise<string>;
    /**
     * Look up a single trust entry by ID. Returns null if the row is
     * missing. Callers (the admin HTTP route, in particular) use this
     * to read a row's source/target routing keys before applying a
     * scope check.
     */
    getById(id: string): Promise<TrustEntry | null>;
    /**
     * Remove a trust relationship by ID.
     */
    removeTrust(id: string): Promise<void>;
    /**
     * List all trust relationships for a routing key (as source or target).
     */
    listTrust(routingKey: string): Promise<TrustEntry[]>;
}
export {};
//# sourceMappingURL=trust-store.d.ts.map