import * as z from "zod/v4";
import { ClosedEnum } from "../types/enums.js";
/**
 * How risky an operation is (declared by the plugin metadata).
 */
export declare const CreateAccessRequestTier: {
    readonly ReadOnly: "read-only";
    readonly Mutating: "mutating";
    readonly Destructive: "destructive";
};
/**
 * How risky an operation is (declared by the plugin metadata).
 */
export type CreateAccessRequestTier = ClosedEnum<typeof CreateAccessRequestTier>;
export type CreateAccessRequestCommand = {
    command: string;
    summary: string;
    params?: any | null | undefined;
    /**
     * How risky an operation is (declared by the plugin metadata).
     */
    tier?: CreateAccessRequestTier | undefined;
};
/**
 * Required with `operationPattern`: the highest risk tier the wildcard grant may cover.
 */
export declare const CreateAccessRequestMaxRisk: {
    readonly ReadOnly: "read-only";
    readonly Mutating: "mutating";
    readonly Destructive: "destructive";
};
/**
 * Required with `operationPattern`: the highest risk tier the wildcard grant may cover.
 */
export type CreateAccessRequestMaxRisk = ClosedEnum<typeof CreateAccessRequestMaxRisk>;
export type CreateAccessRequest = {
    /**
     * Durable replay key scoped to the authenticated requester and workspace. Reusing it with a different validated payload returns ACCESS_REQUEST_REPLAY_MISMATCH.
     */
    replayKey?: string | undefined;
    /**
     * Absolute requester deadline in UTC (Z suffix). Must be in the future and at most six hours ahead (30 seconds clock-skew tolerance). Approvals never extend it. Omit for legacy approval-window behavior.
     */
    requestedExpiresAt?: Date | undefined;
    deploymentId: string;
    /**
     * Set for a plan-backed (ai-agent) request. Omit for a plan-less (CLI) request.
     */
    remediationPlanId?: string | undefined;
    /**
     * Required for a plan-backed request; defaults to the operation/pattern for a plan-less one.
     */
    title?: string | undefined;
    reason?: string | undefined;
    /**
     * Plan-backed only: the exact commands the investigation is requesting.
     */
    commands?: Array<CreateAccessRequestCommand> | undefined;
    /**
     * Plan-less, exact request: a single `plugin/operation`.
     */
    operation?: string | undefined;
    /**
     * Plan-less, wildcard request: `plugin/*`. Requires `maxRisk`.
     */
    operationPattern?: string | undefined;
    /**
     * Params for an exact `operation` request.
     */
    params?: any | null | undefined;
    /**
     * Required with `operationPattern`: the highest risk tier the wildcard grant may cover.
     */
    maxRisk?: CreateAccessRequestMaxRisk | undefined;
};
/** @internal */
export declare const CreateAccessRequestTier$outboundSchema: z.ZodEnum<typeof CreateAccessRequestTier>;
/** @internal */
export type CreateAccessRequestCommand$Outbound = {
    command: string;
    summary: string;
    params?: any | null | undefined;
    tier?: string | undefined;
};
/** @internal */
export declare const CreateAccessRequestCommand$outboundSchema: z.ZodType<CreateAccessRequestCommand$Outbound, CreateAccessRequestCommand>;
export declare function createAccessRequestCommandToJSON(createAccessRequestCommand: CreateAccessRequestCommand): string;
/** @internal */
export declare const CreateAccessRequestMaxRisk$outboundSchema: z.ZodEnum<typeof CreateAccessRequestMaxRisk>;
/** @internal */
export type CreateAccessRequest$Outbound = {
    replayKey?: string | undefined;
    requestedExpiresAt?: string | undefined;
    deploymentId: string;
    remediationPlanId?: string | undefined;
    title?: string | undefined;
    reason?: string | undefined;
    commands?: Array<CreateAccessRequestCommand$Outbound> | undefined;
    operation?: string | undefined;
    operationPattern?: string | undefined;
    params?: any | null | undefined;
    maxRisk?: string | undefined;
};
/** @internal */
export declare const CreateAccessRequest$outboundSchema: z.ZodType<CreateAccessRequest$Outbound, CreateAccessRequest>;
export declare function createAccessRequestToJSON(createAccessRequest: CreateAccessRequest): string;
//# sourceMappingURL=createaccessrequest.d.ts.map