import { Mn as AccessGroupConfig, r as DexConfig } from "./types.openclaw-DdfkPVtj.js";
import { t as ChannelId } from "./channel-id.types-CGgu7V7s.js";
//#region src/plugin-sdk/access-groups.d.ts
/** Resolves membership for an access group using the full OpenClaw config. */
type AccessGroupMembershipResolver = (params: {
  cfg: DexConfig;
  name: string;
  group: AccessGroupConfig;
  channel: ChannelId;
  accountId: string;
  senderId: string;
}) => boolean | Promise<boolean>;
/** Resolves membership for one access group when the caller already selected the config group. */
type AccessGroupMembershipLookup = (params: {
  name: string;
  group: AccessGroupConfig;
  channel: ChannelId;
  accountId: string;
  senderId: string;
}) => boolean | Promise<boolean>;
/** Reports how access-group allowlist entries resolved for a channel sender. */
type ResolvedAccessGroupAllowFromState = {
  referenced: string[];
  matched: string[];
  missing: string[];
  unsupported: string[];
  failed: string[];
  matchedAllowFromEntries: string[];
  hasReferences: boolean;
  hasMatch: boolean;
};
/** Resolves `accessGroup:<name>` allowlist entries without changing the original allowlist. */
declare function resolveAccessGroupAllowFromState(params: {
  accessGroups?: Record<string, AccessGroupConfig>;
  allowFrom: Array<string | number> | null | undefined;
  channel: ChannelId;
  accountId: string;
  senderId: string;
  isSenderAllowed?: (senderId: string, allowFrom: string[]) => boolean;
  resolveMembership?: AccessGroupMembershipLookup;
}): Promise<ResolvedAccessGroupAllowFromState>;
/** Returns the matched `accessGroup:<name>` allowlist entries for a sender. */
declare function resolveAccessGroupAllowFromMatches(params: {
  cfg?: DexConfig;
  allowFrom: Array<string | number> | null | undefined;
  channel: ChannelId;
  accountId: string;
  senderId: string;
  isSenderAllowed?: (senderId: string, allowFrom: string[]) => boolean;
  resolveMembership?: AccessGroupMembershipResolver;
}): Promise<string[]>;
/** Expands a matching access-group allowlist with the concrete sender entry. */
declare function expandAllowFromWithAccessGroups(params: {
  cfg?: DexConfig;
  allowFrom: Array<string | number> | null | undefined;
  channel: ChannelId;
  accountId: string;
  senderId: string;
  senderAllowEntry?: string;
  isSenderAllowed?: (senderId: string, allowFrom: string[]) => boolean;
  resolveMembership?: AccessGroupMembershipResolver;
}): Promise<string[]>;
//#endregion
export { resolveAccessGroupAllowFromMatches as a, expandAllowFromWithAccessGroups as i, AccessGroupMembershipResolver as n, resolveAccessGroupAllowFromState as o, ResolvedAccessGroupAllowFromState as r, AccessGroupMembershipLookup as t };