/**
 * Per-agent permission gate.
 *
 * Consults the AgentGrantStore to decide whether a specific agent may call
 * a specific tool at this instant. Runs BEFORE the existing global-preset
 * check and BEFORE the destructive-confirmation gate, so denials are
 * cheap and conditional permissions are applied consistently.
 *
 * Design notes
 *  - The grant's preset is intersected with the global preset to produce
 *    the effective permissions. A grant can never widen what the global
 *    config allows.
 *  - Expiry is checked at call time. Crossing expiresAt transitions the
 *    grant to "expired" and logs the status change — the MCP client will
 *    get a 401-equivalent on its next call, which is the clearest signal.
 *  - Folder-allowlist + IP-pin checks are advisory here: the gate has
 *    enough context (tool name, args, caller IP) to enforce them, but the
 *    folder check is best-effort (only applied when the tool's args
 *    include a recognizable folder field). A malicious tool that tunnels
 *    folder intent through non-standard args would slip through — acceptable
 *    for v1; we can extend when real misuse patterns appear.
 */
import type { GrantCheckResult } from "./types.js";
import type { ToolName, PermissionPreset } from "../config/schema.js";
import type { AgentGrantStore } from "./grant-store.js";
export interface GrantCheckContext {
    clientId: string;
    tool: ToolName | string;
    args?: Record<string, unknown>;
    callerIp?: string;
    /** The global config preset — the upper bound for the grant. */
    globalPreset: PermissionPreset;
}
export declare class GrantManager {
    private readonly store;
    constructor(store: AgentGrantStore);
    /**
     * Core decision: allowed? Returns a structured result. Callers surface the
     * reason string to the MCP response so the agent can distinguish "not yet
     * approved" from "revoked" from "tool outside your scope".
     */
    check(ctx: GrantCheckContext): GrantCheckResult;
    private checkFolderCondition;
    private globalAllows;
    private readonly permsCache;
    /**
     * Resolve the effective folder allowlist for a caller. Used by tools that
     * return folder-bearing content (e.g., FTS snippets) and need to filter
     * results to the caller's allowed folders independently of the per-call
     * `folder` arg check in {@link check}.
     *
     * Returns:
     *  - `undefined` when there is no grant, the grant has no folder restriction,
     *    or the grant's allowlist is an empty array. Caller should treat
     *    `undefined` as "no restriction — return all folders" to preserve
     *    existing behavior for unscoped grants and stdio/local callers.
     *  - A non-empty `string[]` when the grant's `conditions.folderAllowlist`
     *    is set to a non-empty list. Caller should restrict results to those
     *    folders.
     *
     * Note: this method intentionally does not return `[]` to distinguish
     * "no grant / no restriction" from "explicitly empty allowlist". The
     * grant schema treats an empty allowlist the same as no allowlist; if
     * future revisions tighten that semantic, callers can switch on the
     * returned value's length.
     */
    resolveAllowedFolders(clientId: string): string[] | undefined;
}
//# sourceMappingURL=grant-manager.d.ts.map