/**
 * Shape of the `consent` claim embedded in a FrontMCP-minted access token by
 * {@link LocalPrimaryAuth.signAccessToken}:
 *
 * ```json
 * { "consent": { "enabled": true, "selectedTools": ["app:tool", ...] } }
 * ```
 *
 * Only present when consent mode was enabled for the authorization that minted
 * the token. Its ABSENCE is meaningful: consent disabled ⇒ no enforcement.
 */
export interface ConsentClaim {
    enabled?: boolean;
    selectedTools?: string[];
}
/**
 * Minimal `authInfo` projection this helper reads from. The HTTP request flow
 * nests the verified user under `extra.user` (claims spread in via
 * `deriveTypedUser`, so `consent` is present there); other transports may carry
 * the user at the top level. The verified bearer `token` is the last-resort
 * source — decoding it requires NO re-verification because the token already
 * passed `session:verify` before any tool call runs.
 */
interface ConsentAuthInfoLike {
    token?: string;
    user?: unknown;
    extra?: unknown;
}
/**
 * Extract the consented tool-id set from a verified `authInfo`.
 *
 * Returns:
 * - a `Set<string>` of selected tool ids when the token carries an ENABLED
 *   `consent` claim (the runtime enforcement set), or
 * - `undefined` when there is NO consent metadata — the caller MUST treat this
 *   as "allow" so the default (consent-disabled) behavior is preserved.
 *
 * Resolution order (first hit wins): `extra.user.consent` → `extra.consent`
 * → `user.consent` → decode `token`. All sources are equivalent (they derive
 * from the same verified claims); the fallbacks just make enforcement
 * transport-agnostic.
 *
 * Security: this reads ALREADY-VERIFIED claims. The token decode path uses a
 * no-verify payload decode purely to recover the `consent` claim that some
 * transports drop from the projected `authInfo`; signature trust was
 * established upstream in `auth:verify` / `session:verify`.
 */
export declare function getConsentedToolIds(authInfo: ConsentAuthInfoLike | undefined): Set<string> | undefined;
/**
 * Test whether a tool id is permitted by the consent set returned from
 * {@link getConsentedToolIds}.
 *
 * - `consented === undefined` (no consent metadata) ⇒ always allowed.
 * - otherwise the tool id must be a member of the set.
 *
 * `toolIds` accepts the tool's candidate identifiers (e.g. `fullName` and bare
 * `name`); the tool is allowed if ANY of them was consented, matching the
 * available-tool ids surfaced on the consent screen.
 */
export declare function isToolConsented(consented: Set<string> | undefined, ...toolIds: Array<string | undefined>): boolean;
export {};
//# sourceMappingURL=consent.utils.d.ts.map