/**
 * MCP per-server permission and trust-level management.
 *
 * McpPermissionManager tracks trust levels and per-tool allow/deny overrides
 * for every registered MCP server.
 */
import type { McpTrustLevel, McpTrustMode, McpServerRole, McpAttackPathReview, McpSecuritySnapshot, McpDecisionRecord, McpPermission, McpServerPermissions } from './types.js';
/**
 * Manages per-server permission state.
 *
 * Lifecycle:
 *   1. `registerServer(name)`, called when a server transitions to configured/connecting.
 *   2. `setTrustLevel(name, level)`, adjust trust at runtime.
 *   3. `allowTool(name, tool)` / `denyTool(name, tool)`, explicit overrides.
 *   4. `isToolAllowed(name, tool)`, checked before every tool invocation.
 *   5. `removeServer(name)`, called on permanent disconnection.
 */
export declare class McpPermissionManager {
    private readonly permissions;
    private readonly recentDecisions;
    /**
     * Register a server with default trust level `standard`.
     *
     * Called on every transition to configured/connecting, so it also runs when
     * a server is reconnected after its config was edited in place. When a
     * `profile` is supplied it is treated as the current config and replaces the
     * stored config-derived fields; without one the call stays a no-op for an
     * already-registered server.
     *
     * This used to return early for any known name, which meant an in-place edit
     * (re-adding the same server with new `allowedPaths`/`allowedHosts`) never
     * reached the stored record: `listServerSecurity()` kept reporting the first
     * insert's values, so a reload that correctly counted the server as changed
     * still looked like it had done nothing.
     *
     * Runtime state is not config-derived and is preserved across a refresh: a
     * trust level set through {@link setTrustLevel} and per-tool overrides set
     * through {@link allowTool}/{@link denyTool} both survive.
     *
     * @param serverName - Server identifier
     * @param trustLevel - Initial trust level (defaults to `standard`); ignored
     *                     when the server is already registered
     * @param profile    - Current config-derived profile, if known
     */
    registerServer(serverName: string, trustLevel?: McpTrustLevel, profile?: Partial<McpServerPermissions['profile']>): void;
    /**
     * Remove all permission state for a server.
     *
     * @param serverName - Server identifier
     */
    removeServer(serverName: string): void;
    /**
     * Update the trust level for a registered server.
     *
     * @param serverName - Server identifier
     * @param level      - New trust level
     * @throws {Error} If the server is not registered
     */
    setTrustLevel(serverName: string, level: McpTrustLevel): void;
    /**
     * Return the current trust level for a server, or `null` if not registered.
     *
     * @param serverName - Server identifier
     */
    getTrustLevel(serverName: string): McpTrustLevel | null;
    setTrustMode(serverName: string, mode: McpTrustMode): void;
    getTrustMode(serverName: string): McpTrustMode | null;
    setServerRole(serverName: string, role: McpServerRole): void;
    listProfiles(): Array<McpServerPermissions['profile']>;
    /**
     * Explicitly allow a tool on a server, overriding any deny.
     *
     * @param serverName - Server identifier
     * @param toolName   - Tool name on the server (not qualified)
     * @param note       - Optional reason for the override
     * @throws {Error} If the server is not registered
     */
    allowTool(serverName: string, toolName: string, note?: string): void;
    /**
     * Explicitly deny a tool on a server, overriding trust-level default.
     *
     * @param serverName - Server identifier
     * @param toolName   - Tool name on the server (not qualified)
     * @param note       - Optional reason for the denial
     * @throws {Error} If the server is not registered
     */
    denyTool(serverName: string, toolName: string, note?: string): void;
    /**
     * Remove a per-tool override, reverting to the trust-level default.
     *
     * @param serverName - Server identifier
     * @param toolName   - Tool name on the server
     */
    clearToolOverride(serverName: string, toolName: string): void;
    /**
     * Determine whether a tool call is permitted for the given server.
     *
     * Resolution order:
     *   1. Server not registered → deny
     *   2. Trust level `blocked`  → deny
     *   3. Per-tool override exists → honour override
     *   4. Trust level `restricted` with no allow override → deny
     *   5. Trust level `standard` or `trusted` → allow
     *
     * @param serverName - Server identifier
     * @param toolName   - Tool name on the server (not qualified)
     */
    isToolAllowed(serverName: string, toolName: string): McpPermission;
    evaluateToolCall(serverName: string, toolName: string, args: Record<string, unknown>): McpPermission;
    /**
     * Return a snapshot of permission state for a server, or `null` if not registered.
     *
     * @param serverName - Server identifier
     */
    getServerPermissions(serverName: string): McpServerPermissions | null;
    listRecentDecisions(limit?: number): McpDecisionRecord[];
    buildAttackPathReview(servers: readonly McpSecuritySnapshot[], recentDecisions?: readonly McpDecisionRecord[]): McpAttackPathReview;
    /** All registered server names. */
    get serverNames(): string[];
    private _getRequired;
    private _recordDecision;
}
export declare function buildMcpAttackPathReview(params: {
    servers: readonly McpSecuritySnapshot[];
    recentDecisions?: readonly McpDecisionRecord[] | undefined;
}): McpAttackPathReview;
//# sourceMappingURL=permissions.d.ts.map