/**
 * @module approval
 * OAuth-style approval flow for agents
 *
 * Enterprise agents require explicit user consent before performing
 * sensitive operations. This module implements OAuth-style consent
 * screens and approval tokens.
 */
import type { Result } from '@private.me/shared';
import type { PolicyConstraints } from './agent-call.js';
/**
 * Approval request options
 */
export interface ApprovalOptions {
    /** Agent DID requesting approval */
    readonly agentDid: string;
    /** Scopes being requested (e.g., ["payments:createCharge", "invoices:create"]) */
    readonly scopes: string[];
    /** Policy limits to enforce */
    readonly limits: PolicyConstraints['limits'];
    /** Duration of approval (ISO 8601 duration or ms) */
    readonly duration: string | number;
    /** Human-readable description of what the agent will do */
    readonly description?: string;
    /** Metadata for audit logging */
    readonly metadata?: Record<string, unknown>;
}
/**
 * Approval token (returned after user consent)
 */
export interface ApprovalToken {
    /** Unique approval ID */
    readonly id: string;
    /** Agent DID this approval is for */
    readonly agentDid: string;
    /** Granted scopes */
    readonly scopes: string[];
    /** Granted limits */
    readonly limits: PolicyConstraints['limits'];
    /** Expiration timestamp (ms since epoch) */
    readonly expiresAt: number;
    /** When this approval was created */
    readonly createdAt: number;
    /** Whether this approval is still valid */
    readonly valid: boolean;
    /** JWT-style signature (Ed25519) */
    readonly signature: string;
}
/**
 * Approval result
 */
export interface ApprovalResult {
    /** Whether user approved */
    readonly approved: boolean;
    /** Approval token (if approved) */
    readonly token?: ApprovalToken;
    /** Reason for denial (if not approved) */
    readonly reason?: string;
}
/**
 * Approval error codes
 */
export declare enum ApprovalErrorCode {
    USER_DENIED = "APPROVAL_USER_DENIED",
    TIMEOUT = "APPROVAL_TIMEOUT",
    INVALID_DURATION = "APPROVAL_INVALID_DURATION",
    SIGNATURE_FAILED = "APPROVAL_SIGNATURE_FAILED",
    TOKEN_EXPIRED = "APPROVAL_TOKEN_EXPIRED",
    TOKEN_REVOKED = "APPROVAL_TOKEN_REVOKED",
    INVALID_TOKEN = "APPROVAL_INVALID_TOKEN"
}
/**
 * Approval error
 */
export declare class ApprovalError extends Error {
    readonly code: ApprovalErrorCode;
    readonly details?: Record<string, unknown> | undefined;
    constructor(code: ApprovalErrorCode, message: string, details?: Record<string, unknown> | undefined);
}
/**
 * Approval presenter (UI abstraction)
 *
 * Implementations display consent screen to user and return their decision.
 * This allows different UIs (CLI, web, mobile) to plug in.
 */
export interface ApprovalPresenter {
    /**
     * Present approval request to user
     *
     * @param options - Approval options
     * @returns User's decision
     */
    present(options: ApprovalOptions): Promise<Result<ApprovalResult, ApprovalError>>;
}
/**
 * CLI approval presenter (prints to console, reads stdin)
 * This is a legitimate CLI interface - console output is intentional
 */
export declare class CLIApprovalPresenter implements ApprovalPresenter {
    present(options: ApprovalOptions): Promise<Result<ApprovalResult, ApprovalError>>;
}
/**
 * Approval flow coordinator
 *
 * Orchestrates the consent flow: present to user → sign token → track expiry
 */
export declare class ApprovalFlow {
    private readonly presenter;
    private readonly tokens;
    constructor(options?: {
        readonly presenter?: ApprovalPresenter;
    });
    /**
     * Request approval from user
     *
     * @param options - Approval request options
     * @returns Approval result with token (if approved)
     */
    requestApproval(options: ApprovalOptions): Promise<Result<ApprovalResult, ApprovalError>>;
    /**
     * Verify an approval token
     *
     * @param tokenId - Token ID to verify
     * @returns Token if valid, error otherwise
     */
    verifyToken(tokenId: string): Result<ApprovalToken, ApprovalError>;
    /**
     * Revoke an approval token
     *
     * @param tokenId - Token ID to revoke
     */
    revokeToken(tokenId: string): void;
    /**
     * Parse duration string to milliseconds
     */
    private parseDuration;
    /**
     * Generate a unique token ID
     */
    private generateTokenId;
    /**
     * Sign an approval token (stub - production would use Ed25519)
     */
    private signToken;
}
