/**
 * Module: access-control
 *
 * Directory/file-extension based access control helpers:
 * - `matchesPattern` for glob-like directory scope matching (supports `*` and `**`)
 * - `hasReadAccess`/`hasWriteAccess` to evaluate member permissions
 * - `getAccessDeniedMessage` to format denial responses
 */
import type { LanguageCode } from '@longrun-ai/kernel/types/language';
import { Team } from './team';
/**
 * Directory-specific pattern matching for access control.
 * This function determines if a target path (file or directory) should be controlled
 * by a directory pattern. The pattern represents a directory scope.
 *
 * Supports:
 * - "*" matches any single directory/file name within a path segment
 * - "**" matches any number of directory levels (including zero)
 * - Exact directory matches
 *
 * Directory semantics:
 * - Pattern "src" matches "src/file.txt", "src/subdir/file.js", etc.
 * - Pattern "src" does NOT match "src-backup/file.txt" (prevents false positives)
 * - Pattern "src/tools" matches "src/tools/fs.ts" but not "src/other/file.ts"
 */
export declare function matchesPattern(targetPath: string, dirPattern: string): boolean;
/**
 * Check if a member has read access to a specific path.
 *
 * Access control logic:
 * 1. Check blacklist first (no_read_dirs) - if path matches any blacklist pattern, deny access
 * 2. Check whitelist (read_dirs) - if path matches any whitelist pattern, allow access
 * 3. Check extension blacklist (no_read_file_ext_names) - if extension matches, deny access
 * 4. Check extension whitelist (read_file_ext_names)
 * 5. If no whitelist patterns are defined for a dimension, allow access (default allow)
 * 6. If whitelist patterns exist but none match, deny access
 */
export declare function hasReadAccess(member: Team.Member, targetPath: string): boolean;
/**
 * Check if a member has write access to a specific path.
 *
 * Access control logic:
 * 1. Check blacklist first (no_write_dirs) - if path matches any blacklist pattern, deny access
 * 2. Check whitelist (write_dirs) - if path matches any whitelist pattern, allow access
 * 3. Check extension blacklist (no_write_file_ext_names) - if extension matches, deny access
 * 4. Check extension whitelist (write_file_ext_names)
 * 5. If no whitelist patterns are defined for a dimension, allow access (default allow)
 * 6. If whitelist patterns exist but none match, deny access
 */
export declare function hasWriteAccess(member: Team.Member, targetPath: string): boolean;
/**
 * Get an access denied error message for a specific operation and path.
 */
export declare function getAccessDeniedMessage(operation: 'read' | 'write', targetPath: string, language?: LanguageCode): string;
