import { ActionResponse } from '../../content/content.type';
import { PeopleActionOpts } from '../shared.types';
import { InvokeDeps } from '../_invoke';
/** `validate_revision` — runs publish guards; writes `validationResult`. */
export interface PeopleValidateRevisionOutput {
    valid: boolean;
    errors: unknown[];
    checkedAt: string;
}
/** `fork_draft` (factory on catalog_revision). Duplicate `revisionLabel`
 *  ⇒ `revision_label_conflict`. */
export interface PeopleForkDraftParams {
    revisionLabel: string;
    forkedFrom?: string;
}
/** `seed_merge` (factory on catalog_revision) — merges SETTING
 *  `people.permissionSets` into a draft; idempotent by key, NEVER auto-publishes. */
export interface PeopleSeedMergeParams {
    permissionSets?: string[];
    draftUuid?: string;
}
export interface PeopleSeedMergeOutput {
    draftUuid: string;
    noOp: boolean;
    added: Array<{
        key: string;
    }>;
    unchanged: Array<{
        key: string;
    }>;
    seedDrift: Array<{
        key: string;
        expected: unknown;
        actual: unknown;
    }>;
}
/** `publish_revision` (row on catalog_revision) — guard + atomic publish +
 *  supersede previous in one execution; failure ⇒ `PEOPLE_CAT_DRAFT_MISMATCH`. */
export interface PeoplePublishRevisionOutput {
    revisionLabel: string;
    superseded: string[];
    events: Array<{
        type: string;
        payload?: Record<string, unknown>;
    }>;
}
/** `grant_exception` (factory on scope_exception). Creates directly `active`,
 *  `origin: 'admin'`. Open-ended windows rejected. Grants only widen data-scope. */
export interface PeopleGrantExceptionParams {
    subjectRef: string;
    scopeKey: string;
    effect?: 'grant' | 'deny';
    window: {
        effectiveFrom: string;
        effectiveTo: string;
    };
    justification: string;
    employmentRef?: string;
}
export interface PeopleGrantExceptionOutput {
    exceptionUuid: string;
    subjectRef: string;
    scopeKey: string;
    effect: 'grant' | 'deny';
    origin: 'admin';
    state: 'active';
}
/** `revoke_exception` — justification is REQUIRED by the backend guard
 *  (`justification_required`); every revoke is audited with its reason. */
export interface PeopleRevokeExceptionParams {
    justification: string;
}
/** `amend_exception_window` — only the window is mutable; effect/scopeKey/
 *  justification are locked to their original values. */
export interface PeopleAmendExceptionWindowParams {
    window: {
        effectiveFrom: string;
        effectiveTo: string;
    };
}
/** `grant` guard order: RA11 context → catalog resolve → acting triple →
 *  duplicate/idempotency NO_OP → SoD warn (never blocking) → write + inline
 *  `user_roles` reflect. `accessContextState` is the eaera-hr projection
 *  read the guard keys on: ended ⇒ PEOPLE_RA_CONTEXT_ENDED; scheduled ⇒ the
 *  row starts `prepared` (no enforcement until the sweep activates it). */
export interface PeopleGrantParams {
    subjectRef: string;
    roleKey: string;
    accessContextRef: string;
    assignmentType: 'manual' | 'birthright' | 'requested' | 'emergency';
    accessContextState: 'active' | 'scheduled' | 'ended';
    purpose?: 'standard' | 'acting';
    effectiveFrom?: string;
    effectiveTo?: string;
    justification?: string;
    ticketRef?: string;
    idempotencyKey?: string;
    sodWarnPatterns?: string[];
}
export interface PeopleGrantOutput {
    assignmentUuid: string;
    state: 'prepared' | 'active';
    sodWarnings: Array<{
        pattern: string;
        detail?: string;
    }>;
    noOp?: boolean;
}
/** `revoke` — reason required; birthright rows additionally write
 *  `manual_override` (blocks re-grant until the rule republishes). */
export interface PeopleRevokeParams {
    reason: string;
}
/** `amend_window` — active rows only; never resurrects inactive rows
 *  (renewal = a new grant). Early acting stop = effectiveTo = now. */
export interface PeopleAmendWindowParams {
    effectiveTo: string;
}
export interface PeopleValidateRuleOutput {
    valid: boolean;
    errors: unknown[];
    checkedAt: string;
}
/** `publish_rule` — guard re-run + supersede of the previous published
 *  version of the same rule_key in ONE execution; conflict ⇒
 *  PEOPLE_RA_RULE_CONFLICT. Emits the RA5 bulk re-evaluation event. */
export interface PeoplePublishRuleOutput {
    state: 'published';
    version: number;
    supersededUuid?: string;
    events: Array<{
        type: string;
        payload?: Record<string, unknown>;
    }>;
}
/** `record_decision` — revoke requires a reason and invokes assignment
 *  `revoke` inline on every assignmentRefs item (RA9); `revoked` carries
 *  the per-outcome result. */
export interface PeopleRecordDecisionParams {
    memberRef: string;
    decision: 'keep' | 'revoke';
    reason?: string;
}
export interface PeopleRecordDecisionOutput {
    decision: 'keep' | 'revoke';
    revoked: Array<{
        assignmentUuid: string;
        ok: boolean;
        result?: unknown;
    }>;
}
/** `generate` — builds items from a caller-supplied reporting line (the
 *  eaera-hr projection supplies it, OQ-5). Idempotent per cycle: an
 *  already-active campaign is a NO_OP; members without a resolvable manager
 *  are created directly `escalated` (fail-soft). */
export interface PeopleGenerateParams {
    cycleConfig?: Record<string, unknown>;
    deadlineAt: string;
    reportingLine: Array<{
        managerRef: string;
        members: Array<{
            memberRef: string;
            assignmentRefs: string[];
        }>;
    }>;
}
export interface PeopleGenerateOutput {
    campaignUuid: string;
    itemCount: number;
    deadlineAt: string;
}
/** `remind` — bookkeeping count of still-pending items (RA8). */
export interface PeopleRemindOutput {
    reminded: number;
}
/** `escalate_review` — pending items past 2× the review window escalate to
 *  the HR admin; NEVER auto-revokes (PM 2026-08-17). */
export interface PeopleEscalateReviewOutput {
    escalated: number;
    escalatedTo?: string;
}
/** `complete` — writes the US6 TC4 compliance evidence. */
export interface PeopleCompleteOutput {
    completionReport: {
        completedAt: string;
        totalItems: number;
        kept: number;
        revoked: number;
        escalated: number;
        reviews: unknown[];
    };
}
export interface PermsActions {
    validateRevision(revisionUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    publishRevision(revisionUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    forkDraft(params: PeopleForkDraftParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    discardDraft(revisionUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    seedMerge(params?: PeopleSeedMergeParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    recordSeedAck(revisionUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    grantException(params: PeopleGrantExceptionParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    revokeException(exceptionUuid: string, params: PeopleRevokeExceptionParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    amendExceptionWindow(exceptionUuid: string, window: {
        effectiveFrom: string;
        effectiveTo: string;
    }, opts?: PeopleActionOpts): Promise<ActionResponse>;
    grant(assignmentUuid: string, params: PeopleGrantParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    /** Type-scoped grant — the pack creates the assignment row itself
     *  (factory semantics; returns `assignment_uuid`). The correct lane
     *  for NEW grants — the row-scoped lane needs a pre-created row whose
     *  triple trips the duplicate NO_OP guard. */
    grantAssignment(params: PeopleGrantParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    revoke(assignmentUuid: string, params: PeopleRevokeParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    amendWindow(assignmentUuid: string, params: PeopleAmendWindowParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    validateRule(ruleUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    publishRule(ruleUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    discardRule(ruleUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    recordDecision(campaignUuid: string, params: PeopleRecordDecisionParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    generate(campaignUuid: string, params: PeopleGenerateParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    remind(campaignUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    escalateReview(campaignUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    complete(campaignUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
}
export declare function buildPermsActions(deps: InvokeDeps): PermsActions;
//# sourceMappingURL=actions.d.ts.map