/**
 * Base Permission Handler
 *
 * Abstract base class for permission handlers that provides common
 * functionality for the Chain of Responsibility pattern.
 *
 * @module declarative-api/permission-chain
 */
import type { IResourceEntity, ResourceType, IPermissionHandler, PermissionRequest, PermissionResult, PermissionLevel } from '../../../lib/runtime-web/types/declarative-api';
/**
 * Abstract base class for permission handlers.
 *
 * Provides common functionality for handling permission requests,
 * including chain delegation and audit logging.
 *
 * @example
 * ```typescript
 * class TablePermissionHandler extends BasePermissionHandler {
 *   readonly priority = 10;
 *   readonly handlerId = 'table-permission-handler';
 *
 *   protected getResourceType(): ResourceType {
 *     return 'dynamodb:table';
 *   }
 *
 *   protected getActionsForLevel(level: PermissionLevel): string[] {
 *     switch (level) {
 *       case 'read': return ['dynamodb:GetItem', 'dynamodb:Query'];
 *       case 'write': return ['dynamodb:PutItem', 'dynamodb:DeleteItem'];
 *       case 'full': return [...readActions, ...writeActions];
 *       default: return [];
 *     }
 *   }
 *
 *   protected grantToRole(role: unknown, actions: string[], resource: IResourceEntity): void {
 *     // Grant permissions using CDK
 *   }
 * }
 * ```
 */
export declare abstract class BasePermissionHandler implements IPermissionHandler {
    abstract readonly priority: number;
    abstract readonly handlerId: string;
    private next;
    /**
     * Get the resource type this handler processes.
     */
    protected abstract getResourceType(): ResourceType;
    /**
     * Get the IAM actions for a given permission level.
     *
     * @param level - The permission level
     * @returns Array of IAM actions
     */
    protected abstract getActionsForLevel(level: PermissionLevel): readonly string[];
    /**
     * Grant permissions to the role.
     * Override this method to implement actual CDK permission grants.
     *
     * @param role - The IAM role (CDK IRole)
     * @param actions - The actions to grant
     * @param resource - The resource to grant access to
     */
    protected abstract grantToRole(role: unknown, actions: readonly string[], resource: IResourceEntity): void;
    /**
     * Check if this handler can process the given resource.
     *
     * @param resource - The resource to check
     * @returns True if this handler can process the resource
     */
    canHandle(resource: IResourceEntity): boolean;
    /**
     * Handle a permission request.
     *
     * @param resource - The resource to grant access to
     * @param role - The IAM role to grant permissions to
     * @param request - The permission request
     * @returns The result of the permission operation
     */
    handle(resource: IResourceEntity, role: unknown, request: PermissionRequest): PermissionResult;
    /**
     * Set the next handler in the chain.
     *
     * @param handler - The next handler
     * @returns The next handler (for chaining)
     */
    setNext(handler: IPermissionHandler): IPermissionHandler;
    /**
     * Get the next handler in the chain.
     *
     * @returns The next handler, or undefined if this is the last handler
     */
    getNext(): IPermissionHandler | undefined;
    /**
     * Resolve actions based on the permission request.
     *
     * @param request - The permission request
     * @returns Array of IAM actions
     */
    protected resolveActions(request: PermissionRequest): readonly string[];
    /**
     * Extract the role ARN from the role object.
     *
     * @param role - The IAM role
     * @returns The role ARN
     */
    protected extractRoleArn(role: unknown): string;
    /**
     * Create an unhandled result when no handler can process the request.
     *
     * @param resource - The resource
     * @param role - The IAM role
     * @param request - The permission request
     * @returns An unhandled permission result
     */
    private createUnhandledResult;
}
