/**
 * Governance input shared by `create-org-service-token` and
 * `set-service-principal-policy`, so a principal is validated the same way
 * whether it is born governed or tightened later.
 */
import { z } from "zod";
import { type ServicePrincipalLifecycle, type ServicePrincipalPolicy, type ServicePrincipalRiskTier } from "../../org/service-principal-policy.js";
export declare const MAX_ALLOWED_ACTIONS = 200;
export declare const riskTierSchema: z.ZodEnum<{
    high: "high";
    low: "low";
    medium: "medium";
}>;
export declare const allowedActionsSchema: z.ZodArray<z.ZodString>;
export declare const ownerEmailSchema: z.ZodString;
export declare const teamSchema: z.ZodString;
export declare const purposeSchema: z.ZodString;
/** Dedupe so the stored grant (and its audited count) has no repeats. */
export declare function normalizeAllowedActions(allowed: string[] | null | undefined): string[] | null | undefined;
/**
 * The owner must be a person in this org. A service identity is refused by
 * name so the answer is a clear 400 rather than a membership miss, and an
 * unreadable membership store is a 503, never "not a member".
 */
export declare function assertOwnerIsOrgMember(orgId: string, ownerEmail: string): Promise<string>;
export interface ServicePrincipalView {
    serviceName: string;
    serviceEmail: string;
    state: "ungoverned" | ServicePrincipalLifecycle;
    ownerEmail: string | null;
    team: string | null;
    riskTier: ServicePrincipalRiskTier | null;
    purpose: string | null;
    /** `null` is unrestricted. */
    allowedActions: string[] | null;
    lifecycleReason: string | null;
    lifecycleChangedBy: string | null;
    lifecycleChangedAt: number | null;
}
/** No policy row is "ungoverned": a legacy principal that is active and unrestricted. */
export declare function describeServicePrincipal(orgId: string, serviceName: string, policy: ServicePrincipalPolicy | null | undefined): ServicePrincipalView;
/**
 * A name with neither a token nor a policy is a typo, not a principal; refusing
 * it keeps governance rows from accumulating for names that can never act.
 */
export declare function requireKnownServicePrincipal(orgId: string, serviceName: string): Promise<ServicePrincipalPolicy | null>;
/** Normalize a user-supplied name; a name with no usable characters is a 400. */
export declare function parseServiceName(raw: string): string;