/**
 * Which agents may use a connected account.
 *
 * A connector (Google Workspace, Canva, Microsoft To Do, …) is one grant for the whole
 * instance, so without this every agent can read the owner's mail the
 * moment the owner connects it. Skills carry `X-Agent-Session`, so the
 * backend can tell which role is calling and refuse.
 *
 * The default is **open**: a connector with no allowlist is usable by every
 * agent, which is what installs had before this existed. An allowlist names
 * exactly the roles allowed — `orchestrator` included, so the owner can
 * keep even the orc out of their inbox. The owner's own calls (the
 * dashboard, no `X-Agent-Session`) are never gated.
 *
 * Stored at `<CREWLY_HOME>/connector-access.json`.
 *
 * @module services/connector/connector-access.service
 */
/** Per-connector access rule. */
export interface ConnectorAccess {
    /** Roles allowed to use it. Empty = every agent. */
    allowedRoles: string[];
}
/** The whole file: connector id → rule. */
export type ConnectorAccessMap = Record<string, ConnectorAccess>;
/** Connector ids the backend gates (must match the frontend catalog). */
export declare const GATED_CONNECTORS: readonly ["google-workspace", "canva", "microsoft-todo"];
/** One of {@link GATED_CONNECTORS}. */
export type GatedConnectorId = (typeof GATED_CONNECTORS)[number];
/**
 * Reads and writes the per-connector role allowlists.
 */
export declare class ConnectorAccessService {
    private static instance;
    private readonly logger;
    private readonly filePath;
    private cache;
    /**
     * @param crewlyHome - Override the home directory (tests)
     */
    constructor(crewlyHome?: string);
    static getInstance(): ConnectorAccessService;
    /** Reset the singleton (tests). */
    static resetInstance(): void;
    /**
     * Every rule on file.
     *
     * @returns Connector id → rule (connectors with no rule are absent)
     */
    list(): Promise<ConnectorAccessMap>;
    /**
     * The allowlist for one connector.
     *
     * @param connectorId - Connector id
     * @returns Its roles (empty = open to every agent)
     */
    allowedRoles(connectorId: string): Promise<string[]>;
    /**
     * Replace a connector's allowlist.
     *
     * @param connectorId - Connector id
     * @param roles - Allowed roles; empty opens it to every agent
     * @returns The stored rule
     */
    setAllowedRoles(connectorId: string, roles: string[]): Promise<ConnectorAccess>;
    /**
     * Drop a connector's rule (it goes back to open). Used when the connector
     * itself is removed, so a later one with the same id starts open.
     *
     * @param connectorId - Connector id
     * @returns True when a rule existed
     */
    removeRule(connectorId: string): Promise<boolean>;
    /**
     * Whether a caller may use a connector.
     *
     * @param connectorId - Connector id
     * @param role - Caller role; undefined = the owner (always allowed)
     * @returns True when allowed
     */
    isAllowed(connectorId: string, role: string | undefined): Promise<boolean>;
    /** Drop the in-memory copy (tests, or an external edit of the file). */
    invalidate(): void;
}
//# sourceMappingURL=connector-access.service.d.ts.map