/**
 * Perms domain — projection read: `GET /api/v1/people/access/audit`.
 *
 * Composes catalog_revision + scope_exception × engine grant rows (live
 * engine `user_roles` joined with `effective_permissions`) into a single
 * Q-A/Q-B answer — see api_references §6.1.
 *
 * Performance target: <2s @ 10K users (FR-007e). Field→FAP group mapping is
 * caller-provided (OQ-5 — see data-design §3.7a).
 */
export interface PeopleAccessAuditQuery {
    mode: 'who-has-permission' | 'who-can-see-field';
    /** Q-A (permission key) | Q-B (field key) — required for the chosen mode. */
    target?: string;
    field?: string;
    record?: string;
    /** Optional filters, live since FEAT-008 shipped (api_references §6.1). */
    assignmentType?: string;
    purpose?: string;
}
export interface PeopleAccessAuditItemBase {
    subject: string;
}
/** Q-A item: subjects + roles + scopeRefs + assignmentType/purpose. */
export interface PeopleAccessAuditItemQa extends PeopleAccessAuditItemBase {
    roles: string[];
    scopeRefs: string[];
    /** Live FEAT-008 provenance (registry §3.21 — read from the
     *  `user_roles.metadata` block `grant_reflect` writes); `null` for
     *  engine-native grants the pack never touched. */
    assignmentType: 'manual' | 'birthright' | 'requested' | 'emergency' | null;
    purpose: 'standard' | 'acting' | null;
}
/** Q-B item: permission ∩ data-scope ∩ FAP fieldGroup AND with blockedBy. */
export interface PeopleAccessAuditItemQb extends PeopleAccessAuditItemBase {
    allowed: boolean;
    blockedBy: 'permission' | 'scope' | 'fap';
    maskLevel?: 'hidden' | 'partial' | 'full';
}
export type PeopleAccessAuditItem = PeopleAccessAuditItemQa | PeopleAccessAuditItemQb;
export interface PeopleAccessAuditResult {
    mode: PeopleAccessAuditQuery['mode'];
    count: number;
    items: PeopleAccessAuditItem[];
    durationMs: number;
}
//# sourceMappingURL=projections.d.ts.map