import type { FrontMcpLogger } from '../../common';
import type { SkillSessionManager } from '../session/skill-session.manager';
import type { ToolAuthorizationResult, SkillPolicyMode } from '../session/skill-session.types';
/**
 * Options for the ToolAuthorizationGuard.
 */
export interface ToolAuthorizationGuardOptions {
    /**
     * Whether to throw an error when a tool is not allowed.
     * If false, returns the authorization result without throwing.
     * @default true
     */
    throwOnDenied?: boolean;
    /**
     * Callback for handling approval requests.
     * Called when policyMode is 'approval' and tool is not in allowlist.
     */
    onApprovalRequired?: (toolName: string, skillId: string | undefined) => Promise<boolean>;
    /**
     * Callback for logging tool authorization attempts.
     */
    onAuthorizationCheck?: (result: ToolAuthorizationResult) => void;
}
/**
 * Guard that checks tool authorization against the active skill session.
 *
 * This guard is used to enforce tool allowlists defined by skills.
 * It integrates with the SkillSessionManager to check if a tool
 * is authorized for the current skill session.
 *
 * @example
 * ```typescript
 * const guard = new ToolAuthorizationGuard(sessionManager, logger);
 *
 * // Before executing a tool
 * await guard.check('github_get_pr');  // Throws if not allowed in strict mode
 *
 * // Or get the result without throwing
 * const result = await guard.check('github_get_pr', { throwOnDenied: false });
 * if (!result.allowed) {
 *   // Handle denial
 * }
 * ```
 */
export declare class ToolAuthorizationGuard {
    private readonly sessionManager;
    private readonly logger?;
    private readonly defaultOptions;
    constructor(sessionManager: SkillSessionManager, logger?: FrontMcpLogger, options?: ToolAuthorizationGuardOptions);
    /**
     * Check if a tool is authorized for the current skill session.
     *
     * @param toolName - Name of the tool to check
     * @param options - Override options for this check
     * @returns Authorization result
     * @throws ToolNotAllowedError if tool is not allowed and throwOnDenied is true
     * @throws ToolApprovalRequiredError if approval is required and not granted
     */
    check(toolName: string, options?: ToolAuthorizationGuardOptions): Promise<ToolAuthorizationResult>;
    /**
     * Check authorization and return a simple boolean.
     * Does not throw errors.
     */
    isAllowed(toolName: string): Promise<boolean>;
    /**
     * Get the current policy mode.
     */
    getPolicyMode(): SkillPolicyMode;
    /**
     * Check if there's an active skill session.
     */
    hasActiveSkill(): boolean;
    /**
     * Get the tool allowlist for the current skill.
     */
    getAllowlist(): string[];
    /**
     * Approve a tool for the current session.
     * Used when handling manual approval flows.
     */
    approveTool(toolName: string): void;
    /**
     * Deny a tool for the current session.
     */
    denyTool(toolName: string): void;
}
//# sourceMappingURL=tool-authorization.guard.d.ts.map