/**
 * Unified permission resolver.
 *
 * Chains: static rules → consent flow → default policy.
 *
 * Replaces the fragmented permission checking in:
 * - host.ts checkPermission() (server-level only)
 * - host.ts governedCallTool() (no consent integration)
 * - governance.ts PermissionMatcher (rules only, no consent)
 * - consent-flow.ts ConsentAwareResolver (consent only, no rules)
 */
import { EventEmitter } from 'events';
import { PermissionMatcher, ToolPermissionLevel, ToolPermissionRule, GovernanceRule } from './governance.js';
import { ConsentFlowManager, ConsentDecision, ConsentRequest } from './consent-flow.js';
export interface PermissionResolution {
    /** Final decision */
    level: ToolPermissionLevel;
    /** Source of the decision */
    source: 'rule' | 'consent' | 'default';
    /** Human-readable reason */
    reason: string;
    /** The rule that matched (if source is 'rule') */
    matchedRule?: ToolPermissionRule;
    /** The consent request (if source is 'consent') */
    consentRequest?: ConsentRequest;
}
export interface UnifiedResolverOptions {
    /** Default permission when no rule or consent matches */
    defaultLevel?: ToolPermissionLevel;
    /** Default reason for default permission */
    defaultReason?: string;
    /** Enable consent flow for ASK decisions */
    enableConsent?: boolean;
    /** Custom consent flow options */
    consentOptions?: {
        timeoutMs?: number;
        promptFn?: (request: ConsentRequest) => Promise<ConsentDecision>;
    };
}
export declare class UnifiedPermissionResolver extends EventEmitter {
    private readonly matcher;
    private readonly consentResolver;
    private readonly defaultLevel;
    private readonly defaultReason;
    constructor(rules: GovernanceRule[], options?: UnifiedResolverOptions);
    /**
     * Resolve permission for a tool call.
     *
     * Resolution order:
     * 1. Static rules (highest priority)
     * 2. Consent flow (for ASK decisions)
     * 3. Default policy
     */
    resolvePermission(toolName: string, serverName?: string, args?: Record<string, unknown>): Promise<PermissionResolution>;
    /**
     * Update rules (e.g., when config changes).
     */
    updateRules(rules: GovernanceRule[]): void;
    /**
     * Get the underlying PermissionMatcher (for testing).
     */
    getMatcher(): PermissionMatcher;
    /**
     * Get the underlying ConsentFlowManager (for testing).
     */
    getConsentManager(): ConsentFlowManager | null;
}
