/**
 * Entity-type access policy service.
 *
 * Controls guest (external agent) write and read access on a per-entity-type
 * basis. This is complementary to the per-agent grant system: grants whitelist
 * specific agents, while access policies define what any authenticated guest
 * can do with a given entity_type.
 *
 * Modes (most restrictive to most open):
 *   - closed (default)       — no guest access
 *   - read_only              — guests can read, cannot write
 *   - submit_only            — guests can write, cannot read
 *   - submitter_scoped       — guests can write and read only their own
 *   - open                   — guests can write and read everything
 *
 * Configuration resolution order (highest priority first):
 *   1. Env var NEOTOMA_ACCESS_POLICY_<ENTITY_TYPE_UPPERCASED>=<mode>
 *   2. SchemaMetadata.guest_access_policy on the active schema row
 *   3. Persisted config file (deprecated fallback)
 *   4. Default: closed
 */
export type AccessPolicyMode = "closed" | "read_only" | "submit_only" | "submitter_scoped" | "open";
declare const VALID_MODES: Set<AccessPolicyMode>;
declare const DEFAULT_MODE: AccessPolicyMode;
export interface AccessPolicyMap {
    [entityType: string]: AccessPolicyMode;
}
export type AccessPolicySource = "env" | "schema_metadata" | "config_file" | "default";
export interface AccessPolicyResolution {
    mode: AccessPolicyMode;
    source: AccessPolicySource;
}
export interface AccessPolicyEntry extends AccessPolicyResolution {
    entity_type: string;
}
/**
 * Load all effective non-default access policies with their winning source.
 *
 * Precedence per key: env var > schema metadata > config file.
 */
export declare function loadAccessPolicyEntries(): Promise<Record<string, AccessPolicyEntry>>;
/**
 * Load all effective non-default access policies.
 *
 * Precedence per key: env var > schema metadata > config file.
 */
export declare function loadAccessPolicies(): Promise<AccessPolicyMap>;
/**
 * Resolve the access policy for a specific entity type.
 *
 * Precedence: env var > schema metadata > config file (deprecated) > default.
 */
export declare function resolveAccessPolicyWithSource(entityType: string): Promise<AccessPolicyResolution>;
export declare function resolveAccessPolicy(entityType: string): Promise<AccessPolicyMode>;
/**
 * Set the access policy for an entity type in persisted config.
 */
export declare function setAccessPolicy(entityType: string, mode: AccessPolicyMode): Promise<void>;
/**
 * Reset the access policy for an entity type (removes from config, defaults to closed).
 */
export declare function resetAccessPolicy(entityType: string): Promise<void>;
/**
 * Batch-set multiple entity types to the same mode.
 */
export declare function setAccessPolicies(entityTypes: string[], mode: AccessPolicyMode): Promise<void>;
/**
 * Batch-reset multiple entity types to default (closed).
 */
export declare function resetAccessPolicies(entityTypes: string[]): Promise<void>;
export interface GuestIdentity {
    thumbprint?: string;
    sub?: string;
    iss?: string;
    accessToken?: string;
}
export type GuestOp = "store" | "retrieve";
export interface AccessPolicyDecision {
    allowed: boolean;
    mode: AccessPolicyMode;
    reason: string;
    scopeFilter?: "submitter_only";
}
/**
 * Enforce access policy for a guest operation on a set of entity types.
 *
 * Returns a decision per entity_type. Callers should check `allowed` and,
 * for retrieve operations, apply `scopeFilter` when present.
 */
export declare function enforceGuestAccess(op: GuestOp, entityTypes: string[], _identity: GuestIdentity): Promise<Map<string, AccessPolicyDecision>>;
/**
 * Check whether a guest write is allowed for ALL entity types in a batch.
 * Returns true if every entity_type in the batch permits writes.
 * Throws with a structured error if any type denies.
 */
export declare function assertGuestWriteAllowed(entityTypes: string[], identity: GuestIdentity): Promise<void>;
/**
 * Determine read access for a guest on a specific entity type.
 * Returns the decision including any scope filter to apply.
 */
export declare function resolveGuestReadAccess(entityType: string, identity: GuestIdentity): Promise<AccessPolicyDecision>;
export declare class AccessPolicyError extends Error {
    readonly code: "access_policy_denied";
    readonly statusCode = 403;
    readonly op: GuestOp;
    readonly entityType: string;
    readonly mode: AccessPolicyMode;
    readonly policyReason: string;
    constructor(params: {
        op: GuestOp;
        entityType: string;
        mode: AccessPolicyMode;
        reason: string;
    });
    toErrorEnvelope(): {
        code: string;
        message: string;
        op: GuestOp;
        entity_type: string;
        mode: AccessPolicyMode;
        reason: string;
        hint: string;
    };
}
/** Entity types that form the GitHub Issues submission surface. */
export declare const ISSUE_SUBMISSION_ENTITY_TYPES: readonly ["issue", "conversation", "conversation_message"];
export { VALID_MODES, DEFAULT_MODE };
//# sourceMappingURL=access_policy.d.ts.map