export type Channel = 'whatsapp' | 'telegram' | 'slack' | 'discord' | 'email' | 'sms' | 'web' | 'any';
export type Role = 'owner' | 'team' | 'customer' | 'lead' | 'supplier' | 'contact';
export type AddedBy = 'owner' | 'agent_outreach' | 'auto' | 'onboarding';
export interface AllowedContact {
    id: string;
    tenant_id: string;
    channel: Channel;
    identifier: string;
    display_name: string | null;
    role: Role;
    added_by: AddedBy;
    reason: string | null;
    granted_until: string | null;
    enabled: boolean;
    last_inbound_at: string | null;
    created_at: string;
}
/**
 * Normalize a channel identifier so lookups are deterministic across
 * inbound paths. WhatsApp arrives as +966xxx, Telegram as tg-<id>, email
 * lowercased.
 */
export declare function normalizeIdentifier(channel: Channel, raw: string): string;
export interface AddInput {
    channel: Channel;
    identifier: string;
    display_name?: string;
    role?: Role;
    added_by?: AddedBy;
    reason?: string;
    granted_until?: string;
}
export declare function addAllowed(tenantId: string, input: AddInput): Promise<AllowedContact | null>;
export interface AccessDecision {
    allowed: boolean;
    reason: string;
    contact: AllowedContact | null;
    policyMode: 'auto' | 'ask' | 'never';
}
/**
 * Decide whether to route an inbound DM to the brain. The flow:
 *   1. If the sender is on the allow list → allow.
 *   2. Otherwise look up the inbound_access policy:
 *      - 'auto'  → allow but auto-add (legacy / open mode for first-touch UX)
 *      - 'ask'   → block + caller should queue an escalation
 *      - 'never' → block silently
 */
export declare function decideInbound(tenantId: string, channel: Channel, identifier: string, displayName: string | null): Promise<AccessDecision>;
/**
 * Convenience helper for outbound tools: when the agent contacts someone
 * (send_email, send_whatsapp, schedule_followup, etc.), auto-allow them so
 * their reply routes through. The tool layer should call this so customers
 * never have to manually re-authorize an inbound reply.
 */
export declare function recordOutreach(tenantId: string, channel: Channel, identifier: string, displayName: string | null, role?: Role): Promise<void>;
export declare function listAllowed(tenantId: string, channel?: Channel): Promise<AllowedContact[]>;
export declare function removeAllowed(tenantId: string, channel: Channel, identifier: string): Promise<void>;
//# sourceMappingURL=allowlist.d.ts.map