import type { FigmaScopeRef } from "./figmaScopeRef.js";
export declare const FIGMA_CONSENT_SCHEMA_VERSION: 1;
/**
 * Display-only list of the least-privilege, read-only Figma scopes the connector relies on. Shown to
 * the operator before the first fetch so they can confirm the PAT they minted is read-only. The
 * connector reads files and renders images; it never writes. Figma PAT scopes are coarse, so this is
 * the human-readable expectation, not an enforced grant.
 */
export declare const EXPECTED_FIGMA_SCOPES: readonly string[];
export interface FigmaScopeConsent {
    readonly figmaConsentSchemaVersion: typeof FIGMA_CONSENT_SCHEMA_VERSION;
    readonly scopeRef: FigmaScopeRef;
    /** Always true once recorded: the operator acknowledged the read-only, least-privilege scope. */
    readonly readOnlyAcknowledged: true;
    /** Display-only echo of the scopes acknowledged. No token, no board reference. */
    readonly acknowledgedScopes: readonly string[];
    readonly acknowledgedBy: string;
    readonly acknowledgedAt: string;
}
export declare const loadReadOnlyConsent: (scopeRef: FigmaScopeRef, evidenceDir: string) => FigmaScopeConsent | undefined;
export declare const hasReadOnlyConsent: (scopeRef: FigmaScopeRef, evidenceDir: string) => boolean;
export interface RecordReadOnlyConsentInput {
    readonly scopeRef: FigmaScopeRef;
    readonly evidenceDir: string;
    readonly acknowledgedBy: string;
    readonly now: string;
}
/**
 * Record the operator's explicit acknowledgement of the read-only, least-privilege scope. Idempotent
 * by overwrite (re-acknowledging refreshes the timestamp). Returns the stored consent record.
 */
export declare const recordReadOnlyConsent: (input: RecordReadOnlyConsentInput) => FigmaScopeConsent;
/**
 * Gate the first fetch on recorded consent. Throws a coded, safe error when the operator has not yet
 * acknowledged the read-only scope for this connected scope. The connector calls this BEFORE token
 * materialisation so an unconsented scope never reaches Figma.
 */
export declare const assertReadOnlyConsent: (scopeRef: FigmaScopeRef, evidenceDir: string) => void;
//# sourceMappingURL=figmaConsent.d.ts.map