import { DecisionStrategy } from '@authup/kit';
import { Container } from 'validup';
import { z } from 'zod';
import { RealmScope } from '../realm-scope';
import type { AuthorizationCatalog, AuthorizationEvaluatorInput, AuthorizationGrant } from './types';
/**
 * A policy node as it travels. Deliberately LOOSE: every key beyond `type` is
 * that type's own configuration, and `projectAuthorizationPolicy` is what
 * validates it, by running the type's own validator. Mounting a node in a
 * validup container would strip every key the container does not mount, and
 * the whole configuration would go with it.
 */
export declare const authorizationPolicySchema: z.ZodObject<{
    type: z.ZodString;
}, z.core.$loose>;
/**
 * One permission definition. `policies` carries the ids of its
 * definition-layer trees, or `null` when the server could not project one.
 */
export declare const authorizationDefinitionSchema: z.ZodObject<{
    name: z.ZodString;
    realm_id: z.ZodNullable<z.ZodString>;
    client_id: z.ZodNullable<z.ZodString>;
    decision_strategy: z.ZodNullable<z.ZodEnum<typeof DecisionStrategy>>;
    policies: z.ZodNullable<z.ZodArray<z.ZodString>>;
}, z.core.$strip>;
export declare const authorizationCatalogSchema: z.ZodObject<{
    policies: z.ZodRecord<z.ZodString, z.ZodObject<{
        type: z.ZodString;
    }, z.core.$loose>>;
    permissions: z.ZodArray<z.ZodObject<{
        name: z.ZodString;
        realm_id: z.ZodNullable<z.ZodString>;
        client_id: z.ZodNullable<z.ZodString>;
        decision_strategy: z.ZodNullable<z.ZodEnum<typeof DecisionStrategy>>;
        policies: z.ZodNullable<z.ZodArray<z.ZodString>>;
    }, z.core.$strip>>;
}, z.core.$strip>;
/**
 * One grant of the identity, as the introspection endpoints report it.
 * Whether a grant's policy ids are declared is checked against the catalog
 * the consumer holds, since the two travel separately.
 */
export declare const authorizationGrantSchema: z.ZodObject<{
    name: z.ZodString;
    realm_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    client_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    realm_scope: z.ZodOptional<z.ZodNullable<z.ZodEnum<typeof RealmScope>>>;
    policies: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
}, z.core.$strip>;
export declare const authorizationIdentitySchema: z.ZodObject<{
    id: z.ZodString;
    type: z.ZodEnum<{
        user: "user";
        client: "client";
    }>;
    realmId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    realmName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    clientId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
}, z.core.$strip>;
/**
 * The whole input `createAuthorizationEvaluator` takes: the catalog
 * `GET /authorization` serves, the grants an introspection reports and the
 * identity it names. A validup container over zod mounts, the shape every
 * validator in this package uses, so a consumer can reuse or override one
 * member's rules instead of restating the document.
 */
export declare class AuthorizationEvaluatorInputValidator extends Container<AuthorizationEvaluatorInput> {
    initialize(): void;
}
export type AuthorizationEvaluatorInputParsed = {
    catalog: AuthorizationCatalog;
    grants: AuthorizationGrant[];
    identity: AuthorizationEvaluatorInput['identity'];
};
/**
 * Validate the evaluator's input, plus the two rules per-key validators
 * cannot express.
 *
 * Every id a definition names must be a key of `policies`: a dangling id
 * resolves to `undefined`, which reads as "this layer carries no policy", so
 * a catalog that merely omitted a tree would grant unrestricted access rather
 * than fail. The lookup is own-property only, so an id such as `constructor`
 * cannot be answered by a member of `Object.prototype`.
 *
 * And the identity and its grants travel together: grants without an identity
 * belong to nobody, while an identity without a grant list is the shape an
 * INACTIVE introspection produces (`permissions` is absent unless the
 * credential is active), which read as "holds nothing" would authorize every
 * definition that carries no binding check. An identity holding no grant says
 * so with an empty array.
 */
export declare function parseAuthorizationEvaluatorInput(input: AuthorizationEvaluatorInput): Promise<AuthorizationEvaluatorInputParsed>;
/**
 * One verdict: the permission namespace and the requested realms it holds in.
 * A realm value is a realm key the caller itself supplied, or `null` for the
 * global rows, so nothing here is resolved or looked up.
 */
export declare const authorizationCheckPermissionSchema: z.ZodObject<{
    name: z.ZodString;
    realms: z.ZodArray<z.ZodNullable<z.ZodString>>;
}, z.core.$strip>;
export declare const authorizationCheckPermissionsSchema: z.ZodArray<z.ZodObject<{
    name: z.ZodString;
    realms: z.ZodArray<z.ZodNullable<z.ZodString>>;
}, z.core.$strip>>;
//# sourceMappingURL=schema.d.ts.map