import { z } from "zod";
/**
 * Policy-bundle envelope — ONE versioned shape shared by the local
 * `aih-org-policy.json` (embedded whole as `policy`) and a future SIGNED org
 * bundle an org distributes to its fleet. The envelope adds only provenance
 * (`bundleVersion`, `issuer`, `issuedAt`) and optional ring metadata around the
 * existing {@link OrgPolicySchema}; it never forks the policy shape itself, so a
 * repo validating its local policy and a fleet validating a distributed bundle
 * are exercising the SAME schema. No network code and no signing live here —
 * signing rides `SHA256SUMS` like every other aih artifact, and the read-only
 * gate over both forms is `aih policy validate`.
 */
/** Deployment-ring metadata a bundle may carry (names only; rollout logic is future work). */
declare const PolicyRingSchema: z.ZodObject<{
    name: z.ZodString;
    description: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export declare const PolicyBundleSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<1>;
    bundleVersion: z.ZodString;
    issuer: z.ZodString;
    issuedAt: z.ZodISODateTime;
    policy: z.ZodObject<{
        schemaVersion: z.ZodLiteral<2>;
        minimumPosture: z.ZodEnum<{
            enterprise: "enterprise";
            vibe: "vibe";
        }>;
        references: z.ZodObject<{
            repoContract: z.ZodString;
        }, z.core.$strip>;
        command: z.ZodOptional<z.ZodObject<{
            deny: z.ZodOptional<z.ZodObject<{
                add: z.ZodDefault<z.ZodArray<z.ZodObject<{
                    pattern: z.ZodString;
                    reason: z.ZodOptional<z.ZodString>;
                }, z.core.$strict>>>;
                remove: z.ZodDefault<z.ZodArray<z.ZodString>>;
            }, z.core.$strict>>;
            ask: z.ZodOptional<z.ZodObject<{
                add: z.ZodDefault<z.ZodArray<z.ZodObject<{
                    pattern: z.ZodString;
                    reason: z.ZodOptional<z.ZodString>;
                }, z.core.$strict>>>;
                remove: z.ZodDefault<z.ZodArray<z.ZodString>>;
            }, z.core.$strict>>;
        }, z.core.$strict>>;
        riskGates: z.ZodOptional<z.ZodObject<{
            add: z.ZodDefault<z.ZodArray<z.ZodObject<{
                name: z.ZodString;
                description: z.ZodString;
                pathPatterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
                commandPatterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
            }, z.core.$strict>>>;
            override: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
                description: z.ZodOptional<z.ZodString>;
                pathPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
                commandPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
            }, z.core.$strict>>>;
        }, z.core.$strict>>;
        licenses: z.ZodOptional<z.ZodObject<{
            disposition: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
                alert: "alert";
                "auto-approve": "auto-approve";
                block: "block";
                fail: "fail";
            }>>>;
        }, z.core.$strict>>;
        security: z.ZodOptional<z.ZodObject<{
            strix: z.ZodDiscriminatedUnion<[z.ZodObject<{
                targetKind: z.ZodLiteral<"local-fixture">;
                mode: z.ZodEnum<{
                    deep: "deep";
                    quick: "quick";
                    standard: "standard";
                }>;
                maxBudgetCents: z.ZodNumber;
                maxTurns: z.ZodNumber;
                timeoutMs: z.ZodNumber;
                telemetry: z.ZodLiteral<"off">;
                imageDigest: z.ZodString;
                allowLiveTargets: z.ZodDefault<z.ZodLiteral<false>>;
                allowMounts: z.ZodDefault<z.ZodLiteral<false>>;
                enabled: z.ZodLiteral<true>;
                required: z.ZodBoolean;
            }, z.core.$strict>, z.ZodObject<{
                targetKind: z.ZodLiteral<"local-fixture">;
                mode: z.ZodEnum<{
                    deep: "deep";
                    quick: "quick";
                    standard: "standard";
                }>;
                maxBudgetCents: z.ZodNumber;
                maxTurns: z.ZodNumber;
                timeoutMs: z.ZodNumber;
                telemetry: z.ZodLiteral<"off">;
                imageDigest: z.ZodString;
                allowLiveTargets: z.ZodDefault<z.ZodLiteral<false>>;
                allowMounts: z.ZodDefault<z.ZodLiteral<false>>;
                enabled: z.ZodLiteral<false>;
                required: z.ZodLiteral<false>;
            }, z.core.$strict>], "enabled">;
        }, z.core.$strict>>;
        mcp: z.ZodOptional<z.ZodObject<{
            allowedServers: z.ZodDefault<z.ZodArray<z.ZodString>>;
            approvals: z.ZodDefault<z.ZodArray<z.ZodObject<{
                server: z.ZodString;
                subject: z.ZodOptional<z.ZodString>;
                acceptEgress: z.ZodLiteral<true>;
                reason: z.ZodString;
                reviewer: z.ZodOptional<z.ZodString>;
                approvedAt: z.ZodString;
            }, z.core.$strict>>>;
            allowManagedOnly: z.ZodDefault<z.ZodBoolean>;
            incumbentHosts: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
            githubHost: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
            disabledServers: z.ZodDefault<z.ZodArray<z.ZodString>>;
        }, z.core.$strict>>;
        trust: z.ZodOptional<z.ZodObject<{
            approvedSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
                owner: z.ZodString;
                repo: z.ZodString;
                pinnedSha: z.ZodOptional<z.ZodString>;
                reason: z.ZodOptional<z.ZodString>;
            }, z.core.$strict>>>;
            requireSignedSource: z.ZodDefault<z.ZodBoolean>;
            requiredDetectors: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                cisco: "cisco";
                "mcp-scanner": "mcp-scanner";
                semgrep: "semgrep";
                skillspector: "skillspector";
                "snyk-agent-scan": "snyk-agent-scan";
            }>>>;
            requiredChecks: z.ZodOptional<z.ZodArray<z.ZodString>>;
            baselineOverrides: z.ZodOptional<z.ZodArray<z.ZodObject<{
                catalog: z.ZodEnum<{
                    ecc: "ecc";
                    superpowers: "superpowers";
                }>;
                owner: z.ZodString;
                repo: z.ZodString;
                pinnedSha: z.ZodString;
                bundle: z.ZodString;
                signingRepository: z.ZodString;
                reason: z.ZodString;
                reviewer: z.ZodString;
                approvedAt: z.ZodString;
            }, z.core.$strict>>>;
            internalScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
            skillspector: z.ZodOptional<z.ZodObject<{
                approvedDigests: z.ZodDefault<z.ZodArray<z.ZodObject<{
                    imageTag: z.ZodString;
                    imageDigest: z.ZodString;
                    sourceRevision: z.ZodString;
                    reason: z.ZodString;
                    reviewer: z.ZodOptional<z.ZodString>;
                    approvedAt: z.ZodString;
                }, z.core.$strict>>>;
            }, z.core.$strict>>;
        }, z.core.$strict>>;
        capabilityPackages: z.ZodOptional<z.ZodObject<{
            catalog: z.ZodObject<{
                provider: z.ZodLiteral<"github">;
                repository: z.ZodString;
            }, z.core.$strict>;
            roots: z.ZodArray<z.ZodString>;
        }, z.core.$strict>>;
        governance: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
            supportedClis: z.ZodArray<z.ZodEnum<{
                antigravity: "antigravity";
                claude: "claude";
                codex: "codex";
                copilot: "copilot";
                cursor: "cursor";
                gemini: "gemini";
                kimi: "kimi";
                kiro: "kiro";
                opencode: "opencode";
                windsurf: "windsurf";
                zed: "zed";
            }>>;
        }, z.core.$strict>, z.ZodObject<{
            policyVersion: z.ZodString;
            catalog: z.ZodObject<{
                reviewed: z.ZodDefault<z.ZodArray<z.ZodObject<{
                    id: z.ZodString;
                    kind: z.ZodEnum<{
                        framework: "framework";
                        hook: "hook";
                        mcp: "mcp";
                    }>;
                    description: z.ZodString;
                    capabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
                    risks: z.ZodDefault<z.ZodArray<z.ZodString>>;
                    source: z.ZodUnion<readonly [z.ZodObject<{
                        type: z.ZodLiteral<"git">;
                        repository: z.ZodString;
                        commit: z.ZodString;
                        tree: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"package">;
                        registry: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        package: z.ZodString;
                        version: z.ZodString;
                        integrity: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"command">;
                        command: z.ZodString;
                        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
                        executableDigest: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"stdio">;
                        resolver: z.ZodEnum<{
                            npx: "npx";
                            uvx: "uvx";
                        }>;
                        registry: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        package: z.ZodString;
                        version: z.ZodString;
                        integrity: z.ZodString;
                    }, z.core.$strict>, z.ZodUnion<readonly [z.ZodObject<{
                        type: z.ZodLiteral<"remote">;
                        origin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        approval: z.ZodObject<{
                            approvedBy: z.ZodString;
                            authenticationMode: z.ZodString;
                            allowedDataClasses: z.ZodArray<z.ZodString>;
                        }, z.core.$strict>;
                        contentScanned: z.ZodLiteral<false>;
                        administrativeStatus: z.ZodEnum<{
                            approved: "approved";
                            revoked: "revoked";
                        }>;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"remote">;
                        origin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        approval: z.ZodObject<{
                            approvedBy: z.ZodString;
                            authenticationMode: z.ZodString;
                            allowedDataClasses: z.ZodArray<z.ZodString>;
                        }, z.core.$strict>;
                        contentScanned: z.ZodLiteral<false>;
                        toolSurfaceDigest: z.ZodString;
                        verdict: z.ZodEnum<{
                            approved: "approved";
                            drifted: "drifted";
                            revoked: "revoked";
                        }>;
                    }, z.core.$strict>]>, z.ZodObject<{
                        type: z.ZodLiteral<"mcp">;
                        server: z.ZodString;
                        subject: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"hook">;
                        handler: z.ZodLiteral<"usage-metering">;
                        scriptDigest: z.ZodString;
                    }, z.core.$strict>]>;
                    targets: z.ZodArray<z.ZodEnum<{
                        claude: "claude";
                        codex: "codex";
                        kiro: "kiro";
                    }>>;
                    projector: z.ZodEnum<{
                        "framework-contract": "framework-contract";
                        "hook-managed-settings": "hook-managed-settings";
                        "mcp-managed-settings": "mcp-managed-settings";
                        "usage-hook": "usage-hook";
                    }>;
                    lifecycle: z.ZodEnum<{
                        deprecated: "deprecated";
                        retired: "retired";
                        supported: "supported";
                    }>;
                    evidence: z.ZodObject<{
                        record: z.ZodString;
                    }, z.core.$strict>;
                    findings: z.ZodDefault<z.ZodArray<z.ZodEnum<{
                        "auto-executing-hook": "auto-executing-hook";
                        "dependency-confusion": "dependency-confusion";
                        "evidence-identity-drift": "evidence-identity-drift";
                        "hidden-unicode": "hidden-unicode";
                        "malicious-code": "malicious-code";
                        "mandatory-detector-failed": "mandatory-detector-failed";
                        "missing-projector": "missing-projector";
                        "normalized-collision": "normalized-collision";
                        "ownership-conflict": "ownership-conflict";
                        "prompt-injection": "prompt-injection";
                        secrets: "secrets";
                        "unpinned-source": "unpinned-source";
                        "unsafe-path": "unsafe-path";
                        "unsupported-target": "unsupported-target";
                    }>>>;
                    autoExecute: z.ZodDefault<z.ZodBoolean>;
                    framework: z.ZodOptional<z.ZodEnum<{
                        ecc: "ecc";
                        superpowers: "superpowers";
                    }>>;
                    clarification: z.ZodOptional<z.ZodString>;
                    annotation: z.ZodOptional<z.ZodString>;
                }, z.core.$strict>>>;
                custom: z.ZodDefault<z.ZodArray<z.ZodObject<{
                    id: z.ZodString;
                    kind: z.ZodEnum<{
                        framework: "framework";
                        hook: "hook";
                        mcp: "mcp";
                    }>;
                    description: z.ZodString;
                    capabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
                    risks: z.ZodDefault<z.ZodArray<z.ZodString>>;
                    source: z.ZodUnion<readonly [z.ZodObject<{
                        type: z.ZodLiteral<"git">;
                        repository: z.ZodString;
                        commit: z.ZodString;
                        tree: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"package">;
                        registry: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        package: z.ZodString;
                        version: z.ZodString;
                        integrity: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"command">;
                        command: z.ZodString;
                        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
                        executableDigest: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"stdio">;
                        resolver: z.ZodEnum<{
                            npx: "npx";
                            uvx: "uvx";
                        }>;
                        registry: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        package: z.ZodString;
                        version: z.ZodString;
                        integrity: z.ZodString;
                    }, z.core.$strict>, z.ZodUnion<readonly [z.ZodObject<{
                        type: z.ZodLiteral<"remote">;
                        origin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        approval: z.ZodObject<{
                            approvedBy: z.ZodString;
                            authenticationMode: z.ZodString;
                            allowedDataClasses: z.ZodArray<z.ZodString>;
                        }, z.core.$strict>;
                        contentScanned: z.ZodLiteral<false>;
                        administrativeStatus: z.ZodEnum<{
                            approved: "approved";
                            revoked: "revoked";
                        }>;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"remote">;
                        origin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        approval: z.ZodObject<{
                            approvedBy: z.ZodString;
                            authenticationMode: z.ZodString;
                            allowedDataClasses: z.ZodArray<z.ZodString>;
                        }, z.core.$strict>;
                        contentScanned: z.ZodLiteral<false>;
                        toolSurfaceDigest: z.ZodString;
                        verdict: z.ZodEnum<{
                            approved: "approved";
                            drifted: "drifted";
                            revoked: "revoked";
                        }>;
                    }, z.core.$strict>]>, z.ZodObject<{
                        type: z.ZodLiteral<"mcp">;
                        server: z.ZodString;
                        subject: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"hook">;
                        handler: z.ZodLiteral<"usage-metering">;
                        scriptDigest: z.ZodString;
                    }, z.core.$strict>]>;
                    targets: z.ZodArray<z.ZodEnum<{
                        claude: "claude";
                        codex: "codex";
                        kiro: "kiro";
                    }>>;
                    projector: z.ZodEnum<{
                        "framework-contract": "framework-contract";
                        "hook-managed-settings": "hook-managed-settings";
                        "mcp-managed-settings": "mcp-managed-settings";
                        "usage-hook": "usage-hook";
                    }>;
                    lifecycle: z.ZodEnum<{
                        deprecated: "deprecated";
                        retired: "retired";
                        supported: "supported";
                    }>;
                    evidence: z.ZodObject<{
                        record: z.ZodString;
                    }, z.core.$strict>;
                    findings: z.ZodDefault<z.ZodArray<z.ZodEnum<{
                        "auto-executing-hook": "auto-executing-hook";
                        "dependency-confusion": "dependency-confusion";
                        "evidence-identity-drift": "evidence-identity-drift";
                        "hidden-unicode": "hidden-unicode";
                        "malicious-code": "malicious-code";
                        "mandatory-detector-failed": "mandatory-detector-failed";
                        "missing-projector": "missing-projector";
                        "normalized-collision": "normalized-collision";
                        "ownership-conflict": "ownership-conflict";
                        "prompt-injection": "prompt-injection";
                        secrets: "secrets";
                        "unpinned-source": "unpinned-source";
                        "unsafe-path": "unsafe-path";
                        "unsupported-target": "unsupported-target";
                    }>>>;
                    autoExecute: z.ZodDefault<z.ZodBoolean>;
                    framework: z.ZodOptional<z.ZodEnum<{
                        ecc: "ecc";
                        superpowers: "superpowers";
                    }>>;
                    clarification: z.ZodOptional<z.ZodString>;
                    annotation: z.ZodOptional<z.ZodString>;
                }, z.core.$strict>>>;
            }, z.core.$strict>;
            activations: z.ZodDefault<z.ZodArray<z.ZodObject<{
                candidate: z.ZodString;
                state: z.ZodEnum<{
                    active: "active";
                    disabled: "disabled";
                }>;
                targets: z.ZodArray<z.ZodEnum<{
                    claude: "claude";
                    codex: "codex";
                    kiro: "kiro";
                }>>;
                clarification: z.ZodOptional<z.ZodString>;
            }, z.core.$strict>>>;
            authority: z.ZodDefault<z.ZodObject<{
                approvals: z.ZodDefault<z.ZodArray<z.ZodObject<{
                    id: z.ZodString;
                    candidate: z.ZodString;
                    kind: z.ZodEnum<{
                        framework: "framework";
                        hook: "hook";
                        mcp: "mcp";
                    }>;
                    source: z.ZodUnion<readonly [z.ZodObject<{
                        type: z.ZodLiteral<"git">;
                        repository: z.ZodString;
                        commit: z.ZodString;
                        tree: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"package">;
                        registry: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        package: z.ZodString;
                        version: z.ZodString;
                        integrity: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"command">;
                        command: z.ZodString;
                        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
                        executableDigest: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"stdio">;
                        resolver: z.ZodEnum<{
                            npx: "npx";
                            uvx: "uvx";
                        }>;
                        registry: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        package: z.ZodString;
                        version: z.ZodString;
                        integrity: z.ZodString;
                    }, z.core.$strict>, z.ZodUnion<readonly [z.ZodObject<{
                        type: z.ZodLiteral<"remote">;
                        origin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        approval: z.ZodObject<{
                            approvedBy: z.ZodString;
                            authenticationMode: z.ZodString;
                            allowedDataClasses: z.ZodArray<z.ZodString>;
                        }, z.core.$strict>;
                        contentScanned: z.ZodLiteral<false>;
                        administrativeStatus: z.ZodEnum<{
                            approved: "approved";
                            revoked: "revoked";
                        }>;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"remote">;
                        origin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
                        approval: z.ZodObject<{
                            approvedBy: z.ZodString;
                            authenticationMode: z.ZodString;
                            allowedDataClasses: z.ZodArray<z.ZodString>;
                        }, z.core.$strict>;
                        contentScanned: z.ZodLiteral<false>;
                        toolSurfaceDigest: z.ZodString;
                        verdict: z.ZodEnum<{
                            approved: "approved";
                            drifted: "drifted";
                            revoked: "revoked";
                        }>;
                    }, z.core.$strict>]>, z.ZodObject<{
                        type: z.ZodLiteral<"mcp">;
                        server: z.ZodString;
                        subject: z.ZodString;
                    }, z.core.$strict>, z.ZodObject<{
                        type: z.ZodLiteral<"hook">;
                        handler: z.ZodLiteral<"usage-metering">;
                        scriptDigest: z.ZodString;
                    }, z.core.$strict>]>;
                    issuer: z.ZodString;
                    sourceDigest: z.ZodString;
                    evidenceDigest: z.ZodString;
                    projector: z.ZodEnum<{
                        "framework-contract": "framework-contract";
                        "hook-managed-settings": "hook-managed-settings";
                        "mcp-managed-settings": "mcp-managed-settings";
                        "usage-hook": "usage-hook";
                    }>;
                    policyVersion: z.ZodString;
                    reason: z.ZodString;
                    clarification: z.ZodOptional<z.ZodString>;
                    scope: z.ZodArray<z.ZodEnum<{
                        claude: "claude";
                        codex: "codex";
                        kiro: "kiro";
                    }>>;
                    notBefore: z.ZodString;
                    expiresAt: z.ZodString;
                    github: z.ZodObject<{
                        repository: z.ZodString;
                        attestationId: z.ZodString;
                        subjectDigest: z.ZodString;
                    }, z.core.$strict>;
                }, z.core.$strict>>>;
            }, z.core.$strict>>;
            externalCuration: z.ZodDefault<z.ZodArray<z.ZodObject<{
                framework: z.ZodEnum<{
                    ecc: "ecc";
                    superpowers: "superpowers";
                }>;
                items: z.ZodDefault<z.ZodArray<z.ZodObject<{
                    kind: z.ZodEnum<{
                        agent: "agent";
                        command: "command";
                        skill: "skill";
                    }>;
                    id: z.ZodString;
                    source: z.ZodObject<{
                        repository: z.ZodString;
                        commit: z.ZodString;
                        path: z.ZodString;
                    }, z.core.$strict>;
                    audit: z.ZodObject<{
                        record: z.ZodString;
                        digest: z.ZodString;
                    }, z.core.$strict>;
                    clarification: z.ZodOptional<z.ZodString>;
                }, z.core.$strict>>>;
            }, z.core.$strict>>>;
            externalSelections: z.ZodDefault<z.ZodArray<z.ZodObject<{
                framework: z.ZodEnum<{
                    ecc: "ecc";
                    superpowers: "superpowers";
                }>;
                items: z.ZodDefault<z.ZodArray<z.ZodObject<{
                    kind: z.ZodEnum<{
                        agent: "agent";
                        baseline: "baseline";
                        capability: "capability";
                        framework: "framework";
                        lang: "lang";
                        mcp: "mcp";
                        module: "module";
                        runtime: "runtime";
                        skill: "skill";
                    }>;
                    id: z.ZodString;
                    source: z.ZodObject<{
                        repository: z.ZodString;
                        commit: z.ZodString;
                        path: z.ZodString;
                    }, z.core.$strict>;
                }, z.core.$strict>>>;
            }, z.core.$strict>>>;
            eccMcpApprovals: z.ZodDefault<z.ZodArray<z.ZodObject<{
                id: z.ZodEnum<{
                    "browser-use": "browser-use";
                    browserbase: "browserbase";
                    clickhouse: "clickhouse";
                    "cloudflare-docs": "cloudflare-docs";
                    "cloudflare-observability": "cloudflare-observability";
                    "cloudflare-workers-bindings": "cloudflare-workers-bindings";
                    "cloudflare-workers-builds": "cloudflare-workers-builds";
                    codescene: "codescene";
                    confluence: "confluence";
                    devfleet: "devfleet";
                    "ecc-memory-vault": "ecc-memory-vault";
                    evalview: "evalview";
                    "exa-web-search": "exa-web-search";
                    "fal-ai": "fal-ai";
                    filesystem: "filesystem";
                    firecrawl: "firecrawl";
                    "ito-compute": "ito-compute";
                    jira: "jira";
                    laraplugins: "laraplugins";
                    longhand: "longhand";
                    magic: "magic";
                    memory: "memory";
                    memxus: "memxus";
                    nexus: "nexus";
                    "omega-memory": "omega-memory";
                    "parallel-search": "parallel-search";
                    railway: "railway";
                    squish: "squish";
                    supabase: "supabase";
                    "token-optimizer": "token-optimizer";
                    vercel: "vercel";
                }>;
                sourceContentSha256: z.ZodLiteral<"a4426254c55a5352db2672bc86a87f10b0029f5e4ae1b74817841e87d9ab1e57">;
                state: z.ZodEnum<{
                    approved: "approved";
                    revoked: "revoked";
                }>;
                approvedBy: z.ZodString;
                authenticationMode: z.ZodString;
                allowedDataClasses: z.ZodArray<z.ZodString>;
            }, z.core.$strict>>>;
            eccHookControls: z.ZodOptional<z.ZodPipe<z.ZodObject<{
                profile: z.ZodEnum<{
                    minimal: "minimal";
                    standard: "standard";
                    strict: "strict";
                }>;
                disabledIds: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                    [x: string]: string;
                }>>>;
            }, z.core.$strict>, z.ZodTransform<{
                profile: "minimal" | "standard" | "strict";
                disabledIds?: string[] | undefined;
            }, {
                profile: "minimal" | "standard" | "strict";
                disabledIds?: string[] | undefined;
            }>>>;
            supportedClis: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                antigravity: "antigravity";
                claude: "claude";
                codex: "codex";
                copilot: "copilot";
                cursor: "cursor";
                gemini: "gemini";
                kimi: "kimi";
                kiro: "kiro";
                opencode: "opencode";
                windsurf: "windsurf";
                zed: "zed";
            }>>>;
            hookRegistrations: z.ZodDefault<z.ZodArray<z.ZodObject<{
                id: z.ZodString;
                event: z.ZodString;
                command: z.ZodString;
                functionTags: z.ZodArray<z.ZodString>;
                spawns: z.ZodNumber;
                timeout: z.ZodOptional<z.ZodNumber>;
                sourceDisabled: z.ZodDefault<z.ZodBoolean>;
                nativeGroup: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                nativeHook: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                owner: z.ZodDiscriminatedUnion<[z.ZodObject<{
                    kind: z.ZodLiteral<"aih">;
                }, z.core.$strict>, z.ZodObject<{
                    kind: z.ZodLiteral<"third-party">;
                    framework: z.ZodString;
                    declaredControls: z.ZodDefault<z.ZodArray<z.ZodString>>;
                    pin: z.ZodObject<{
                        repository: z.ZodString;
                        commit: z.ZodString;
                        path: z.ZodString;
                        launcherSha256: z.ZodString;
                        runtimeVersion: z.ZodString;
                    }, z.core.$strict>;
                }, z.core.$strict>, z.ZodObject<{
                    kind: z.ZodLiteral<"unknown">;
                    launcherSha256: z.ZodString;
                }, z.core.$strict>], "kind">;
            }, z.core.$strict>>>;
        }, z.core.$strict>]>>;
    }, z.core.$strict>;
    rings: z.ZodOptional<z.ZodArray<z.ZodObject<{
        name: z.ZodString;
        description: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>>;
}, z.core.$strict>;
export type PolicyBundle = z.infer<typeof PolicyBundleSchema>;
export type PolicyRing = z.infer<typeof PolicyRingSchema>;
export type PolicyBundleParse = {
    ok: true;
    bundle: PolicyBundle;
} | {
    ok: false;
    error: string;
};
/**
 * Parse a policy-bundle envelope into a discriminated RESULT rather than a throw
 * (the `readMarketplaceManifest` posture, not `parseOrgPolicy`'s): the consumer
 * is `aih policy validate`, a checker, so a malformed bundle is a FINDING it
 * must report — never a crash. One parse covers BOTH layers (the envelope
 * embeds {@link OrgPolicySchema}), and the error message names WHICH layer
 * failed: issues rooted under `policy` are the embedded org policy, everything
 * else is the envelope itself.
 */
export declare function parsePolicyBundle(value: unknown): PolicyBundleParse;
export {};