import type { HttpClient } from "../core/http.js";
import type { UpdatePolicyRequest, PolicyResponse, PolicyListResponse, OneclawResponse, ConsensusTrigger } from "../types.js";
export interface GrantOptions {
    /** Glob pattern for which secret paths the grant covers (default: "**"). */
    secretPathPattern?: string;
    /** Additional conditions (e.g. IP allow-list, time windows). */
    conditions?: Record<string, unknown>;
    /** ISO-8601 expiry for the grant. */
    expires_at?: string;
    /** Policy effect: "allow" (default) or "deny". */
    effect?: "allow" | "deny";
    /** Priority for conflict resolution (higher wins). Default 0. */
    priority?: number;
    /** Attribute-based conditions (required_tags, principal_role, etc.). */
    attribute_conditions?: Record<string, unknown>;
    /** Consensus trigger — requires multi-party approval for matching operations. */
    consensus_trigger?: ConsensusTrigger;
    /** Signing-time AND conditions (all tiers). Ignored on secret reads. */
    tx_conditions?: Record<string, unknown>;
    /** Policy schema version (1 = legacy, 2 = expression). Default 1. */
    policySchemaVersion?: number;
}
/**
 * Access resource — manage vault access policies (grants) for
 * humans and agents.
 */
export declare class AccessResource {
    private readonly http;
    constructor(http: HttpClient);
    /**
     * Grant a human user access to a vault.
     * @param permissions - e.g. ["read"], ["read", "write"]
     */
    grantHuman(vaultId: string, userId: string, permissions: string[], options?: GrantOptions): Promise<OneclawResponse<PolicyResponse>>;
    /**
     * Grant an agent access to a vault.
     * @param permissions - e.g. ["read"], ["read", "write"]
     */
    grantAgent(vaultId: string, agentId: string, permissions: string[], options?: GrantOptions): Promise<OneclawResponse<PolicyResponse>>;
    /** Update an existing policy's permissions and/or conditions. */
    update(vaultId: string, policyId: string, update: UpdatePolicyRequest): Promise<OneclawResponse<PolicyResponse>>;
    /** Revoke a specific access policy by its ID. */
    revoke(vaultId: string, policyId: string): Promise<OneclawResponse<void>>;
    /** List all access grants (policies) on a vault. */
    listGrants(vaultId: string): Promise<OneclawResponse<PolicyListResponse>>;
}
//# sourceMappingURL=access.d.ts.map