import { type SpatialReviewEditorOriginPolicy } from "@alterno-dev/spatial-review-protocol";
export type SpatialReviewEditorAuthorizationOptions = {
    /** Trust the official Alterno editor origin. Defaults to true. */
    allowOfficialEditor?: boolean;
    /** Exact canonical runtime origins. These are private unless disclosed explicitly. */
    allowedOrigins?: Iterable<string>;
    /** Runtime-only dynamic authorization. It can never be advertised in discovery. */
    allowOrigin?: (origin: string) => boolean;
    /** Trust other loopback origins while the producer is on loopback. Defaults to false. */
    allowLoopbackPeers?: boolean;
};
export type SpatialReviewEditorAuthorizationConfiguration = SpatialReviewEditorAuthorizationOptions & {
    /** Explicit public disclosure. The list must exactly match every finite
     * non-same-origin runtime editor origin, including the official editor. */
    advertiseEditorOriginPolicy?: {
        publicOrigins: Iterable<string>;
    };
};
declare const AUTHORIZATION: unique symbol;
export type SpatialReviewEditorAuthorization = Readonly<{
    [AUTHORIZATION]: true;
    allowOfficialEditor: boolean;
    allowedOrigins: readonly string[];
    allowOrigin?: (origin: string) => boolean;
    allowLoopbackPeers: boolean;
    advertisedOrigins?: readonly string[];
}>;
export type SpatialReviewEditorAuthorizationSource = SpatialReviewEditorAuthorizationOptions | SpatialReviewEditorAuthorization | {
    authorization: SpatialReviewEditorAuthorization;
};
/** Create one immutable authorization decision for reuse by discovery and
 * capture bridges. Runtime origins remain private unless public disclosure is
 * explicitly requested with an exact matching list. */
export declare function createSpatialReviewEditorAuthorization(configuration?: SpatialReviewEditorAuthorizationConfiguration): SpatialReviewEditorAuthorization;
export declare function resolveSpatialReviewEditorAuthorization(source?: SpatialReviewEditorAuthorizationSource): Readonly<{
    [AUTHORIZATION]: true;
    allowOfficialEditor: boolean;
    allowedOrigins: readonly string[];
    allowOrigin?: (origin: string) => boolean;
    allowLoopbackPeers: boolean;
    advertisedOrigins?: readonly string[];
}>;
export declare function spatialReviewEditorOriginAllowed(authorization: SpatialReviewEditorAuthorization, producerOrigin: string, editorOrigin: string): boolean;
/** Return public policy only for a shared configuration whose finite origins
 * were explicitly reviewed for disclosure. */
export declare function spatialReviewEditorOriginPolicy(authorization: SpatialReviewEditorAuthorization, producerUrl: string): SpatialReviewEditorOriginPolicy | undefined;
export {};
//# sourceMappingURL=origin-authorization.d.ts.map