/*---------------------------------------------------------------------------------------------
 *  Copyright (c) Microsoft Corporation. All rights reserved.
 *  Licensed under the MIT License. See License.txt in the project root for license information.
 *--------------------------------------------------------------------------------------------*/
import { _n as SignedCapability } from "./hubRpcConnection-Ba6dm9d-.js";
//#region src/hub/common/hubAccess.d.ts
/**
 * The client-facing wire shapes of the hub's capability-negotiation protocol
 * (`hubAccess::requestAccess`, see {@link hubAccessInterface}). Any hub client —
 * the CLI, the MCP server, or an embedder — speaks these shapes to ask a hub
 * for authority in a single consent prompt.
 */
/** How long a granted capability should live. */
type HubAccessDuration = 'once' | 'shortLived' | 'longLived' | 'persistent';
/** A `serviceId` / `interfaceId` / member matcher (wire shape of `TargetPattern`). */
type HubAccessPattern = {
  readonly exact: string;
} | {
  readonly prefix: string;
};
/** One authority the consumer wants — the wire shape of a `requestAccess` permission. */
interface HubAccessPermission {
  readonly target: {
    readonly serviceId: HubAccessPattern;
    readonly interfaceId: HubAccessPattern;
    readonly interfaceHash?: string;
    readonly members: readonly HubAccessPattern[];
  };
  /** Default false (fail closed). Set true to actually call the members. */
  readonly canInvoke?: boolean;
  /** Default false. Set true to let the consumer re-delegate this authority. */
  readonly canDelegate?: boolean;
  readonly params?: Record<string, unknown>;
}
/** A batched, explicit access request — possibly many permissions in one prompt. */
interface HubAccessRequest {
  readonly consumer: {
    readonly name: string;
    readonly origin?: string;
    readonly purpose?: string;
  };
  /** One or more authorities to request together (single consent prompt). */
  readonly permissions: readonly HubAccessPermission[];
  /** `once` (short-lived), `session` (this connection), or `persistent` (saved). */
  readonly duration?: HubAccessDuration;
}
/**
 * Outcome of a `requestAccess` call. `granted` carries every capability the hub
 * minted plus how many of them were durable and added to the connection's cap
 * bag (a client-side augmentation over the pure wire result).
 */
type HubAccessResult = {
  readonly status: 'granted';
  /** Every capability the hub minted for this request. */
  readonly capabilities: readonly SignedCapability[];
  /** How many of them were durable and added to the connection's cap bag. */
  readonly addedDurable: number;
} | {
  readonly status: 'denied';
  readonly reason?: string;
} | {
  readonly status: string;
  readonly reason?: string;
};
/**
 * Return fresh durable capabilities that collectively cover an explicit access
 * request, or `undefined` when the caller must ask the hub for more authority.
 *
 * This is the broad-request counterpart to checking whether a cap bag covers
 * one concrete call. Clients use it before opening consent so persisted grants
 * are reused without weakening any service/interface/member pattern.
 */
declare function findCoveringCapabilities(capabilities: readonly SignedCapability[], requested: readonly HubAccessPermission[], options?: {
  readonly nowMs?: number;
  readonly freshnessMarginMs?: number;
}): readonly SignedCapability[] | undefined;
//#endregion
export { HubAccessResult as a, HubAccessRequest as i, HubAccessPattern as n, findCoveringCapabilities as o, HubAccessPermission as r, HubAccessDuration as t };
//# sourceMappingURL=hubAccess-DDeQLWpk.d.ts.map