/**
 * Entity permission management for access control.
 *
 * Provides a generalized system for tracking user approvals for accessing
 * specific entities (e.g., integrations, files, APIs). This enables granular
 * per-entity access control where users can approve access to specific
 * resources rather than blanket permissions.
 */
import type { AiEntityType, AiToolPermission } from "@superblocksteam/library-shared/types";
/**
 * Permission key components for scoping.
 * Array of strings that identify the scope (e.g., ["toolName"] or ["category", "readonly"]).
 */
export type PermissionKey = string[];
/**
 * Formatted scope string for storage.
 * Created by joining ToolPermissionKey components with a delimiter.
 */
export type PermissionScope = string;
/**
 * Strategy for determining how permissions are scoped by tool.
 *
 * Different strategies enable different granularities:
 * - Per-tool: Each tool requires separate approval
 * - Per-category: All tools in a category share approvals
 * - Per-access: Separate read/write permissions
 */
export declare abstract class PermissionKeyStrategy {
    /**
     * Generate permission key components for a tool.
     *
     * @param tool - Tool to generate key for
     * @returns Array of key components
     */
    abstract getPermissionKey(permission: AiToolPermission, input: any): PermissionKey;
    /**
     * Format permission key into storage scope string.
     *
     * Default implementation joins components with ':' delimiter.
     *
     * @param key - Permission key components
     * @returns Formatted scope string
     */
    formatScope(key: PermissionKey): PermissionScope;
}
/**
 * Action-based strategy: scope permissions by action type (read/write).
 *
 * Groups tools by the action they perform rather than their specific name.
 * This allows users to approve "read" or "write" operations on entities,
 * and all tools performing that action will share the approval.
 *
 * - readOnly tools → "read" scope
 * - Non-readOnly tools → "write" scope
 */
export declare class ActionBasedPermissionKeyStrategy extends PermissionKeyStrategy {
    getPermissionKey(permission: AiToolPermission, _input?: any): PermissionKey;
}
/**
 * Store for tracking entity-level permissions.
 *
 * This interface abstracts the storage mechanism, allowing different
 * implementations (session-based, persistent, etc.) to be swapped out
 * without changing the access control logic.
 *
 * Permissions are scoped by tool permission scope strings, enabling
 * granular control (e.g., per-tool, per-category, etc.).
 */
export interface EntityPermissionStore {
    /**
     * Check if a tool call has been approved for a specific input and tool name.
     *
     * @param toolName - The name of the tool
     * @param input - The input of the tool call
     * @returns True if the tool call has been approved for this input and tool name
     */
    isToolCallApproved(toolName: string, input: any): boolean;
    /**
     * Approve a tool call for a specific input and tool name.
     *
     * @param toolName - The name of the tool
     * @param input - The input of the tool call
     */
    approveToolCall(toolName: string, input: any): void;
    /**
     * Revoke a tool call.
     *
     * @param toolName - The name of the tool
     * @param input - The input of the tool call
     */
    revokeToolCall(toolName: string, input: any): void;
    /**
     * Check if access to a specific entity has been approved for a scope.
     *
     * @param entityType - The type of entity to check
     * @param entityId - The unique identifier of the entity
     * @param scope - Permission scope (e.g., "toolName", "category:read")
     * @returns True if the entity has been approved for this scope
     */
    isApproved(entityType: AiEntityType, entityId: string | undefined, scope: PermissionScope): boolean;
    /**
     * Approve access to a specific entity for a scope.
     *
     * Once approved, future permission checks for this entity and scope will
     * return true until explicitly revoked or the store is cleared.
     *
     * @param entityType - The type of entity to approve
     * @param entityId - The unique identifier of the entity
     * @param scope - Permission scope (e.g., "toolName", "category:read")
     */
    approve(entityType: AiEntityType, entityId: string | undefined, scope: PermissionScope): void;
    /**
     * Revoke access to a specific entity for a scope.
     *
     * Removes the approval for this entity and scope, requiring re-approval
     * for future access attempts.
     *
     * @param entityType - The type of entity to revoke
     * @param entityId - The unique identifier of the entity
     * @param scope - Permission scope (e.g., "toolName", "category:read")
     */
    revoke(entityType: AiEntityType, entityId: string | undefined, scope: PermissionScope): void;
    /**
     * Clear all entity approvals.
     *
     * Removes all stored approvals across all entity types and scopes.
     */
    clear(): void;
    /**
     * Get all approved entity IDs for a specific entity type and optional scope.
     *
     * Useful for debugging, inspection, and UI display of approved entities.
     *
     * @param entityType - The type of entity to list approvals for
     * @param scope - Optional permission scope. If provided, returns only approvals
     *                for that scope. If omitted, returns all approved entities
     *                across all scopes.
     * @returns Array of approved entity IDs for the given type (and scope)
     */
    getApproved(entityType: AiEntityType, scope?: PermissionScope): string[];
}
/**
 * Session-scoped implementation of entity permission store.
 *
 * Stores approvals in memory for the duration of the session.
 * Approvals are lost when the session ends or the store is cleared.
 *
 * Permissions are scoped, allowing different tools/categories to have
 * independent approval states for the same entity.
 *
 * This implementation is suitable for session-based permission tracking
 * and can be replaced with a persistent implementation if needed.
 */
export declare class SessionEntityPermissionStore implements EntityPermissionStore {
    private permissions;
    private temporaryPermissions;
    constructor();
    isToolCallApproved(toolName: string, input: any): boolean;
    approveToolCall(toolName: string, input: any): void;
    revokeToolCall(toolName: string, input: any): void;
    /**
     * Check if access to a specific entity has been approved for a scope.
     *
     * @param entityType - The type of entity to check
     * @param entityId - The unique identifier of the entity
     * @param scope - Permission scope
     * @returns True if the entity has been approved for this scope
     */
    isApproved(entityType: AiEntityType, entityId: string, scope: PermissionScope): boolean;
    /**
     * Approve access to a specific entity for a scope.
     *
     * @param entityType - The type of entity to approve
     * @param entityId - The unique identifier of the entity
     * @param scope - Permission scope
     */
    approve(entityType: AiEntityType, entityId: string, scope: PermissionScope): void;
    /**
     * Revoke access to a specific entity for a scope.
     *
     * @param entityType - The type of entity to revoke
     * @param entityId - The unique identifier of the entity
     * @param scope - Permission scope
     */
    revoke(entityType: AiEntityType, entityId: string | undefined, scope: PermissionScope): void;
    /**
     * Clear all entity approvals across all scopes.
     */
    clear(): void;
    /**
     * Get all approved entity IDs for a specific entity type and optional scope.
     *
     * @param entityType - The type of entity to list approvals for
     * @param scope - Optional permission scope. If provided, returns only approvals
     *                for that scope. If omitted, returns all approved entities
     *                across all scopes (deduplicated).
     * @returns Array of approved entity IDs for the given type (and scope)
     */
    getApproved(entityType: AiEntityType, scope?: PermissionScope): string[];
}
//# sourceMappingURL=entity-permissions.d.ts.map