import type { ToolTier } from "@oh-my-pi/pi-agent-core";
/** File name of the approval cache inside the agent directory. */
export declare const APPROVAL_CACHE_FILENAME = "approval-cache.db";
/** Grant key for one capability tier: an exact target, a directory key, or a tree key. */
export declare function approvalGrantKey(capability: ToolTier, subject: string): string;
/** Read surface shared by the resolver's checks: which of `keys` any tier holds. */
export interface ApprovalGrantStore {
    present(keys: readonly string[]): ReadonlySet<string>;
}
/** Where a grant lives: this conversation's memory (`session`) or the shared database (`global`). */
export type ApprovalTier = "session" | "global";
/** Grants approved "for this session": one conversation's memory, gone when it ends. */
export declare class SessionApprovals implements ApprovalGrantStore {
    #private;
    present(keys: readonly string[]): ReadonlySet<string>;
    record(key: string): void;
    /** Every key held, in grant order. */
    keys(): string[];
    clear(): void;
}
/** SQLite grant store for one agent directory; see the module comment for its connection rules. */
export declare class ApprovalCache implements ApprovalGrantStore {
    readonly filePath: string;
    constructor(agentDir: string);
    present(keys: readonly string[]): ReadonlySet<string>;
    record(key: string, tool: string): void;
    /** Delete every remembered grant; a missing database has nothing to forget. */
    clear(): void;
}
/** One conversation's session tier plus its agent directory's database. */
export declare class ApprovalGrants implements ApprovalGrantStore {
    readonly session: SessionApprovals;
    readonly global: ApprovalCache;
    constructor(session: SessionApprovals, global: ApprovalCache);
    present(keys: readonly string[]): ReadonlySet<string>;
    record(key: string, tool: string, tier: ApprovalTier): void;
}
/**
 * Cache key for a filesystem target: absolute, symlinks resolved (through the deepest existing
 * ancestor for a path that does not exist yet), case-folded on Windows.
 */
export declare function approvalCacheKeyForPath(target: string): string;
/** Cache key for a directory grant: {@link approvalCacheKeyForPath} plus a trailing separator. */
export declare function approvalDirectoryKey(directory: string): string;
/**
 * Grants for one conversation under an agent directory. Without a `sessionId` the session tier is
 * a fresh, unshared store, so a caller that cannot name its conversation sees global grants only.
 */
export declare function getApprovalGrants(agentDir?: string, sessionId?: string): ApprovalGrants;
/** Keys the session tier of conversation `sessionId` holds under an agent directory; never creates the tier. */
export declare function sessionApprovalGrantKeys(agentDir: string, sessionId: string): string[];
/** Forget every remembered approval under an agent directory: the database and every session tier. */
export declare function clearApprovalGrants(agentDir?: string): void;