/**
 * Entity resolver — maps a human-readable slug to an EntityContext with
 * STS-vended credentials.
 *
 * Uses the membership-based discovery path (GET /membership/me → entity lookup)
 * rather than JWT claims, which are fragile post-migration (see
 * indigo-jwt-claims-fragile-post-migration). Delegates STS vending to the
 * canonical `resolveEntityContext()` in context.ts so we use the actual
 * vault-service endpoint (POST /sts/vend) rather than a made-up one.
 */
import type { MembershipRole } from "./vault-client.js";
import type { EntityContext, VaultServiceConfig } from "./types.js";
export declare class EntityNotFoundError extends Error {
    constructor(slug: string, availableSlugs: string[]);
}
export declare class EntityPermissionError extends Error {
    constructor(slug: string, message?: string);
}
export declare class EntityResolutionError extends Error {
    readonly statusCode: number;
    readonly body?: string | undefined;
    constructor(message: string, statusCode: number, body?: string | undefined);
}
export interface AvailableEntity {
    slug: string;
    uid: string;
    role: MembershipRole;
}
/**
 * Resolve a human-readable entity slug to a fully hydrated EntityContext
 * with STS-scoped credentials ready for S3 operations.
 *
 * Flow:
 * 1. GET /membership/me → list user's active memberships (companyUids)
 * 2. GET /entity/{uid} for each → resolve slug + bucketName
 * 3. Match the requested slug (case-sensitive) — throw EntityNotFoundError
 *    with the list of available slugs if it doesn't match (better UX than
 *    the raw 404 from /entity/by-slug/{slug}).
 * 4. Delegate to resolveEntityContext(uid) → POST /sts/vend (the actual
 *    vault-service endpoint).
 */
export declare function resolveEntity(opts: {
    slug: string;
    vaultConfig: VaultServiceConfig;
}): Promise<EntityContext>;
/**
 * List all entities the caller has access to, with slug, UID, and role.
 * Used by `hq sources entities` / `hq signals entities` for discovery.
 */
export declare function listAvailableEntities(opts: {
    vaultConfig: VaultServiceConfig;
}): Promise<AvailableEntity[]>;
//# sourceMappingURL=entity-resolver.d.ts.map