/**
 * `checkAccess` — the access preflight.
 *
 * Answers "can I operate against environment X, and if not, what is the
 * one thing blocking me?" in a single offline call. It aggregates the
 * three gates an operation must clear — config, workspace policy, and
 * credentials — so an agent learns every blocker at once instead of
 * discovering them one failed call at a time.
 *
 * Offline by design: config read + policy resolution + credential
 * presence, no network. A fast preflight, not a health probe. The MCP
 * `access_check` tool is the thin wrapper over this.
 */
import { type Remediation } from "../shared/errors.js";
import { type HumanOnlyOperation } from "../shared/human-only-operations.js";
/** Per-gate verdict. `warn` is non-blocking — informational only. */
export type GateStatus = "ok" | "blocked" | "warn";
/** One gate in the access preflight. */
export interface AccessGate {
    id: "config" | "policy" | "credentials";
    status: GateStatus;
    /** One-line human summary of the gate's verdict. */
    summary: string;
    /** Structured remediation — present iff `status` is `blocked`. */
    remediation?: Remediation;
}
/** The full preflight result. */
export interface AccessReport {
    environment: string;
    /** True when no gate is `blocked` — the environment is ready to use. */
    ready: boolean;
    gates: AccessGate[];
    /**
     * The first blocking gate's remediation, hoisted so a caller can act
     * on the single next step without scanning `gates`.
     */
    nextStep?: Remediation;
    /**
     * Operations no agent can perform regardless of gate state — a human
     * must run them. Surfaced so the caller never mistakes one for an
     * agent-clearable blocker.
     */
    humanOnlyOperations: readonly HumanOnlyOperation[];
}
export interface CheckAccessOptions {
    /** Directory holding `sitecoreai.cli.json`, or a path to it. */
    configPath: string;
    /** Environment profile name to preflight. */
    environmentName: string;
}
/**
 * Run the three-gate preflight for one environment. Never throws — every
 * failure mode (missing config, denied policy, absent credential) is
 * reported as a `blocked` gate with a structured remediation.
 */
export declare const checkAccess: (options: CheckAccessOptions) => Promise<AccessReport>;