export interface AndroidDerivation {
    permissions: string[];
    manifestEntries: string[];
    foregroundService: {
        required: boolean;
        types: string[];
        declaration: string | null;
        devInstructions: string | null;
    };
    notificationListener: {
        required: boolean;
        declaration: string | null;
        devInstructions: string | null;
    };
    minimumSdk: number;
    compileSdk: number;
    targetSdk: number;
}
export interface IosDerivation {
    plistKeys: Array<{
        key: string;
        value: string;
        reason: string;
    }>;
}
export interface MetaDatDerivation {
    scopes: string[];
    registrationRequired: boolean;
    registrationSteps: string[];
}
export declare function deriveAndroidFromCapabilities(capabilities: readonly string[]): AndroidDerivation;
export declare function deriveIosFromCapabilities(capabilities: readonly string[]): IosDerivation;
/** A build-time value the scaffold bakes in that is NOT an OS permission, and
 *  therefore was invisible to a tool that only ever answered "permissions". */
export interface IntegrationConfigValue {
    /** The literal key, as it appears in the build. */
    key: string;
    /** Where it lives on this platform. */
    where: string;
    /** Where a developer OBTAINS the value. The field whose absence cost a
     *  shipped integration: naming a required value without naming its source
     *  leaves an agent to invent a placeholder. */
    source: string;
    /** What happens when it is absent or unresolved. */
    ifMissing: string;
}
/**
 * The other half of "what my app needs configured" — the Extentos-owned values,
 * as opposed to the OS-owned permissions above.
 *
 * Why this exists. `getPermissions` is the tool an agent calls to learn what
 * goes in Info.plist, and for its whole life it answered only the privacy-string
 * half: for a voice assistant it returned two keys and summarised "iOS: 2
 * Info.plist key(s) required." The project key was not among them. An agent that
 * applied exactly what this tool returned shipped an app that builds cleanly,
 * runs perfectly in the simulator (which authenticates with a sim-session token
 * instead), and cannot authenticate in production — surfacing as
 * `AssistantError.NoApiKey`, an error whose name has nothing to do with the
 * cause, in a product whose defining feature is that it has no API keys.
 *
 * That is not hypothetical: it is how a real integration reached a release
 * candidate on 2026-08-12 with an unresolved `$(EXTENTOS_PROJECT_KEY)`
 * placeholder in its Info.plist.
 *
 * `source` is the load-bearing field. The failure was never that nobody said the
 * key was needed — the docs said so, and the developer knew — it was that no
 * surface said where one comes from, so a build-setting placeholder got invented
 * to hold a value that was never going to arrive.
 */
export declare function integrationConfigValues(platform: "android" | "ios"): IntegrationConfigValue[];
/** A permission the OS will not grant without the APP asking at runtime. */
export interface RuntimeGrant {
    /** What is being granted, in the platform's own words. */
    permission: string;
    /** Who asks: the app, or the SDK on its behalf. */
    requestedBy: "app" | "sdk";
    /** The call the app makes, when it is the app's job. */
    call?: string;
    /** What happens when nobody asks. */
    ifMissing: string;
}
export interface RuntimeGrantDerivation {
    grants: RuntimeGrant[];
    note: string;
}
/**
 * The half of "permissions" that is NOT a manifest entry.
 *
 * This tool answered only the manifest half for its whole life, and the name
 * `getPermissions` reads like it covers everything — so an agent that applies
 * every returned key reasonably concludes permissions are done. On iOS that
 * ships a voice app which never asks for the microphone: no prompt, no error,
 * no transcripts, every wake phrase and voice command silently dead. And the
 * simulator cannot reveal it, because there transcripts arrive from the browser
 * and never touch the phone's microphone at all.
 *
 * Found 2026-08-04 by an agent that followed the scaffold exactly and shipped a
 * mute app to real hardware.
 *
 * Deliberately narrow: it lists only grants whose ownership has been read off
 * the SDK source, not everything that might need one. A confident wrong entry
 * here is worse than a missing one.
 */
export declare function deriveRuntimeGrantsFromCapabilities(capabilities: readonly string[], platform: "android" | "ios"): RuntimeGrantDerivation;
export declare function deriveMetaDatFromCapabilities(capabilities: readonly string[]): MetaDatDerivation;
export declare const CAPABILITY_NEEDS_KEYS: readonly string[];
export declare const KNOWN_CAPABILITIES: readonly string[];
//# sourceMappingURL=permissions.d.ts.map