import type { CustomAgentHandle } from "./notion-as-code/custom-agent.js";
import type { DataSourceHandle, DatabaseHandle, SingleSourceDatabaseHandle } from "./notion-as-code/database.js";
import type { PageHandle } from "./notion-as-code/page.js";
/** A Notion-as-Code resource that can provide a named workflow binding. */
export type WorkflowAccessResource = PageHandle | DatabaseHandle | SingleSourceDatabaseHandle | DataSourceHandle | CustomAgentHandle;
type WorkflowAccessContentResource = Exclude<WorkflowAccessResource, CustomAgentHandle>;
/** Resource kinds accepted by workflow access declarations. */
export type WorkflowAccessResourceType = WorkflowAccessResource["resourceType"];
/** Levels accepted by pages, databases, and data sources. */
export type ResourceAccessLevel = "view" | "comment" | "edit" | "fullAccess";
/** The only level accepted by a custom agent. */
export type WorkflowAccessAgentLevel = "call";
/** Every level accepted by at least one workflow access resource. */
export type WorkflowAccessLevel = ResourceAccessLevel | WorkflowAccessAgentLevel;
/** The level set accepted by a particular resource kind. */
export type WorkflowAccessLevelFor<TType extends WorkflowAccessResourceType> = TType extends "customAgent" ? WorkflowAccessAgentLevel : ResourceAccessLevel;
type AccessResourceFor<TType extends WorkflowAccessResourceType> = Extract<WorkflowAccessResource, {
    resourceType: TType;
}>;
/** A named binding declaration pairing one NaC handle with its allowed level. */
export type WorkflowAccessDeclaration = {
    [TType in WorkflowAccessResourceType]: {
        readonly resource: AccessResourceFor<TType>;
        readonly level: WorkflowAccessLevelFor<TType>;
    };
}[WorkflowAccessResourceType];
/** Named binding declarations keyed by the names exposed on workflow context. */
export type WorkflowAccessDeclarations = Readonly<Record<string, WorkflowAccessDeclaration>>;
/** A normalized named-binding requirement, including the required NaC resourceId. */
export type WorkflowAccessRequirement = {
    [TType in WorkflowAccessResourceType]: {
        readonly type: TType;
        readonly resourceId: string;
        readonly level: WorkflowAccessLevelFor<TType>;
    };
}[WorkflowAccessResourceType];
/** Normalized named-binding requirements keyed by public alias. */
export type WorkflowAccessRequirements = Readonly<Record<string, WorkflowAccessRequirement>>;
/** The resolved NaC binding exposed to a workflow handler. */
export type WorkflowAccessValue<TType extends WorkflowAccessResourceType = WorkflowAccessResourceType> = Readonly<{
    type: TType;
    id: string;
}>;
/** Resolved access values keyed by their public aliases. */
export type WorkflowAccess<TAccess extends WorkflowAccessDeclarations = WorkflowAccessDeclarations> = Readonly<{
    [TKey in keyof TAccess]: TAccess[TKey] extends {
        readonly resource: {
            readonly resourceType: infer TType;
        };
    } ? TType extends WorkflowAccessResourceType ? WorkflowAccessValue<TType> : never : never;
}>;
/** Resolved NaC bindings keyed by public aliases, without declaration metadata. */
export type WorkflowAccessBindings = Readonly<Record<string, WorkflowAccessValue>>;
/** Create type-safe access declarations for Notion-as-Code resource handles. */
export declare const access: {
    view: typeof view;
    comment: typeof comment;
    edit: typeof edit;
    fullAccess: typeof fullAccess;
    call: typeof call;
};
declare function view<TResource extends WorkflowAccessContentResource>(resource: TResource): Readonly<{
    resource: TResource;
    level: "view";
}>;
declare function comment<TResource extends WorkflowAccessContentResource>(resource: TResource): Readonly<{
    resource: TResource;
    level: "comment";
}>;
declare function edit<TResource extends WorkflowAccessContentResource>(resource: TResource): Readonly<{
    resource: TResource;
    level: "edit";
}>;
declare function fullAccess<TResource extends WorkflowAccessContentResource>(resource: TResource): Readonly<{
    resource: TResource;
    level: "fullAccess";
}>;
declare function call(resource: CustomAgentHandle): Readonly<{
    resource: CustomAgentHandle;
    level: "call";
}>;
/**
 * Normalize public binding declarations without retaining the handle objects.
 * Handles contain methods and schema objects, so they must never be cloned into
 * the manifest or captured by the runtime transport. These declarations do not
 * grant or change the workflow's existing Notion-module permissions.
 */
export declare function normalizeWorkflowAccess(declarations: WorkflowAccessDeclarations | undefined): WorkflowAccessRequirements;
/**
 * Check one access entry and return its resource type, ID, and level.
 * Workflows check the entry's alias separately; custom-agent grants have no alias.
 */
export declare function normalizeAccessDeclaration(declaration: unknown, label: string): WorkflowAccessRequirement;
/**
 * Resolve trusted per-invocation NaC bindings into the minimal context value.
 * This exposes only declared aliases and does not determine Notion API
 * authorization; the workflow's existing Notion-module permissions do that.
 * The environment is deliberately not parsed when no binding is required.
 */
export declare function hydrateWorkflowAccess<TAccess extends WorkflowAccessDeclarations>(requirements: WorkflowAccessRequirements | undefined): WorkflowAccess<TAccess>;
export {};
//# sourceMappingURL=workflow-access.d.ts.map