export type AuthorizationSubject = {
    kind: 'human' | 'service' | 'workload' | 'agent' | 'connection' | 'worker';
    id: string;
};
export type ResourceScopeKind = 'APPLICATION' | 'COLLECTION' | 'RESOURCE' | 'RESOURCE_PREFIX' | 'WORKLOAD' | 'CONNECTION' | 'ARTIFACT';
export interface AuthorizationResource {
    uri: string;
    attributes?: Record<string, string>;
}
export interface ResourceScope {
    kind: ResourceScopeKind;
    uri: string;
}
export interface GrantConstraints {
    environments?: string[];
    worker_class?: string;
    network?: string;
    workload_id?: string;
    connection_enabled?: boolean;
    minimum_schema_version?: number;
    subject_attributes?: Record<string, string>;
    resource_attributes?: Record<string, string>;
    context_attributes?: Record<string, string>;
}
export interface AuthorizationContext {
    environment?: string;
    execution_id?: string;
    workload_id?: string;
    worker_id?: string;
    connection_id?: string;
    timestamp: number;
    attributes?: Record<string, string>;
}
export interface Grant {
    contract_version: 1;
    id: string;
    issuer: AuthorizationSubject;
    subject: AuthorizationSubject;
    tenant_id: string;
    application_id: string;
    capabilities: string[];
    resources: ResourceScope[];
    constraints?: GrantConstraints;
    issued_at: number;
    expires_at: number;
    parent_grant?: string;
    revision: number;
    status: 'ACTIVE' | 'REVOKED' | 'EXPIRED' | 'SUPERSEDED';
}
export interface SignedGrant {
    algorithm: 'ED25519-V1';
    key_id: string;
    grant: Grant;
    digest: string;
    signature: string;
}
export interface AuthorizationRequest {
    subject: AuthorizationSubject;
    tenant_id: string;
    application_id: string;
    resource: AuthorizationResource;
    capability: string;
    context: AuthorizationContext;
    grant_id?: string;
    subject_attributes?: Record<string, string>;
}
export interface AuthorizationDecision {
    decision_id: string;
    request_hash: string;
    decision_hash: string;
    allowed: boolean;
    subject: AuthorizationSubject;
    tenant_id: string;
    application_id: string;
    resource: AuthorizationResource;
    capability: string;
    grant_id?: string;
    policy_version: string;
    evaluated_at: number;
    reason: string;
}
export declare class AuthorizationClient {
    private readonly baseUrl;
    private readonly fetcher;
    constructor(baseUrl?: string, fetcher?: typeof fetch);
    private json;
    check(request: AuthorizationRequest): Promise<AuthorizationDecision>;
    verificationKey(): Promise<{
        algorithm: "ED25519-V1";
        key_id: string;
        public_key: string;
    }>;
    create(grant: Grant): Promise<SignedGrant>;
    inspect(id: string): Promise<SignedGrant>;
    revoke(id: string): Promise<SignedGrant>;
    delegate(parentId: string, grant: Grant): Promise<SignedGrant>;
    decision(id: string): Promise<AuthorizationDecision>;
}
//# sourceMappingURL=authorization.d.ts.map