/**
 * Approval Manifest for Matimo.
 *
 * Manages HMAC-signed approval records for agent-created tools.
 * Prevents agent forgery of approvals via cryptographic verification.
 */
export interface ApprovalRecord {
    name: string;
    hash: string;
    signature: string;
    approvedAt: string;
    approvedBy?: string;
}
export declare class ApprovalManifest {
    private readonly secret;
    private readonly manifestPath;
    private cache;
    private pendingSet;
    private readonly ttlSeconds;
    /**
     * @param approvalDir - Directory where `.matimo-approvals.json` lives
     * @param secret - HMAC secret. If not provided, reads `MATIMO_APPROVAL_SECRET`
     *   from env. If that's also missing, generates one and logs it.
     * @param ttlSeconds - Optional TTL in seconds. Approvals older than this are treated as expired.
     */
    constructor(approvalDir: string, secret?: string, ttlSeconds?: number);
    /**
     * Compute the HMAC signature for a tool approval.
     */
    private sign;
    /**
     * Compute SHA-256 hash of content.
     */
    computeHash(content: string): string;
    /**
     * Verify that an approval record has a valid HMAC signature and
     * the stored hash matches the current YAML content hash.
     */
    isApproved(toolName: string, currentYamlHash: string): boolean;
    /**
     * Approve a tool. Creates an HMAC-signed record in the manifest.
     */
    approve(toolName: string, yamlHash: string, approvedBy?: string): void;
    /**
     * Revoke a tool's approval. Removes from both cache and pendingSet
     * to ensure consistent state (tool no longer tracked as approved or pending).
     */
    revoke(toolName: string): boolean;
    /**
     * Get the approval record for a tool.
     */
    getApproval(toolName: string): ApprovalRecord | undefined;
    /**
     * List all approved tool names.
     */
    listApproved(): string[];
    /**
     * Mark a tool as pending approval. Called by matimo_create_tool after writing to disk.
     */
    markPending(toolName: string): void;
    /**
     * Return all tool names that have been proposed (written to disk) but not yet approved.
     */
    getPendingTools(): string[];
    /**
     * Load the manifest file from disk.
     */
    private loadFromDisk;
    /**
     * Save current approvals to disk using atomic write pattern.
     * Writes to a temporary file first, then atomically renames it.
     * This prevents data corruption if the process crashes mid-write.
     */
    private saveToDisk;
}
//# sourceMappingURL=approval-manifest.d.ts.map