/**
 * Sync Interceptor
 *
 * Central control point for all sync operations. Wraps sync operations with
 * permission checks and audit logging. Implements the interceptor pattern to
 * ensure consistent enforcement across all platforms (GitHub, JIRA, ADO).
 *
 * Pattern:
 *   Request → Interceptor → Permission Check → Execute/Deny → Log → Response
 *
 * @module core/sync/sync-interceptor
 */
import { PermissionEnforcer, SyncOperation, ItemOrigin, PermissionResult } from './permission-enforcer.js';
import { SyncAuditLogger } from './sync-audit-logger.js';
import { SyncPlatform } from '../types/sync-config.js';
import { Logger } from '../../utils/logger.js';
/**
 * Interceptor result - wraps the operation result with metadata
 */
export interface InterceptorResult<T> {
    /**
     * Whether the operation was allowed
     */
    allowed: boolean;
    /**
     * The result of the operation (null if denied or error)
     */
    result: T | null;
    /**
     * Permission check result
     */
    permission: PermissionResult;
    /**
     * Duration of the operation in milliseconds
     */
    durationMs: number;
    /**
     * Error if operation failed
     */
    error?: Error;
}
/**
 * Sync interceptor options
 */
export interface SyncInterceptorOptions {
    /**
     * Permission enforcer instance
     */
    permissionEnforcer: PermissionEnforcer;
    /**
     * Audit logger instance
     */
    auditLogger: SyncAuditLogger;
    /**
     * Logger instance
     */
    logger?: Logger;
    /**
     * Enable strict mode - throw on permission denial instead of returning null
     * @default false
     */
    strictMode?: boolean;
}
/**
 * Permission denied error
 */
export declare class PermissionDeniedError extends Error {
    readonly permission: PermissionResult;
    readonly platform: SyncPlatform;
    readonly operation: SyncOperation;
    constructor(permission: PermissionResult, platform: SyncPlatform, operation: SyncOperation);
}
/**
 * SyncInterceptor - Central control point for sync operations
 *
 * All sync operations must pass through this interceptor to ensure:
 * 1. Permissions are checked before execution
 * 2. All attempts are logged (success, denied, error)
 * 3. Consistent behavior across all platforms
 *
 * Usage:
 * ```typescript
 * const result = await interceptor.intercept(
 *   'github',
 *   'upsert-internal',
 *   'FS-001',
 *   'internal',
 *   () => this.githubClient.createIssue(item)
 * );
 *
 * if (result.allowed) {
 *   return result.result;
 * } else {
 *   console.log(`Denied: ${result.permission.reason}`);
 * }
 * ```
 */
export declare class SyncInterceptor {
    private readonly permissionEnforcer;
    private readonly auditLogger;
    private readonly logger;
    private readonly strictMode;
    constructor(options: SyncInterceptorOptions);
    /**
     * Intercept a sync operation
     *
     * Checks permissions, executes if allowed, logs the result.
     *
     * @param platform - Target platform (github, jira, ado)
     * @param operation - Operation type (read, update-status, upsert-internal, upsert-external)
     * @param itemId - Item ID being operated on
     * @param origin - Item origin (internal or external)
     * @param execute - Function to execute if permitted
     * @returns Interceptor result with operation outcome
     */
    intercept<T>(platform: SyncPlatform, operation: SyncOperation, itemId: string, origin: ItemOrigin, execute: () => Promise<T>): Promise<InterceptorResult<T>>;
    /**
     * Intercept with automatic origin detection
     */
    interceptAuto<T>(platform: SyncPlatform, operation: SyncOperation, itemId: string, execute: () => Promise<T>): Promise<InterceptorResult<T>>;
    /**
     * Intercept a read operation (always allowed)
     */
    interceptRead<T>(platform: SyncPlatform, itemId: string, execute: () => Promise<T>): Promise<InterceptorResult<T>>;
    /**
     * Intercept a status update operation
     */
    interceptStatusUpdate<T>(platform: SyncPlatform, itemId: string, execute: () => Promise<T>): Promise<InterceptorResult<T>>;
    /**
     * Intercept an upsert operation - determines operation type from item origin
     */
    interceptUpsert<T>(platform: SyncPlatform, itemId: string, execute: () => Promise<T>): Promise<InterceptorResult<T>>;
    /**
     * Check if an operation would be allowed (without executing)
     */
    wouldAllow(platform: SyncPlatform, operation: SyncOperation, itemId: string): boolean;
    /**
     * Get permission summary
     */
    getPermissionsSummary(): string;
    /**
     * Detect item origin from ID - external items end with 'E' or contain '-E-'
     */
    private detectOrigin;
}
/**
 * Create a SyncInterceptor with default configuration
 *
 * @param permissionEnforcer - Permission enforcer instance
 * @param specweavePath - Path to .specweave directory
 * @param logger - Optional logger
 */
export declare function createSyncInterceptor(permissionEnforcer: PermissionEnforcer, specweavePath: string, logger?: Logger): Promise<SyncInterceptor>;
//# sourceMappingURL=sync-interceptor.d.ts.map