import type { Grant } from './ability-builder';
export declare const SNAPSHOT_SCHEMA_VERSION = 1;
/** A serialized CASL rule (post $ctx-substitution). Shape accepted by createPrismaAbility. */
export interface AbilityRule {
    action: string | string[];
    subject: string | string[];
    /** Field-level allow-list (Step 1 fields[]). Empty/absent = all fields. */
    fields?: string[];
    /** Prisma WhereInput-shaped conditions (already substituted; no $ctx left). */
    conditions?: Record<string, unknown>;
    /** CASL `cannot` rule. */
    inverted?: boolean;
    /** Audit-only; excluded from permHash. */
    reason?: string;
}
export interface SnapshotEnvelope {
    schemaVersion: number;
    snapId: string;
    userId: string;
    /** Generic multi-tenancy key the snapshot was built for (the user's acting tenant). */
    tenantId?: string;
    /** sha256(canonical(sortedRules)) truncated to 32 hex (Step 4 DEC-S4.7/9). */
    permHash: string;
    /** epoch ms — drives refresh-ahead (DEC-S4.30). */
    builtAt: number;
    /** Rules pre-substituted by the BUILDER's registry (skillID). Fast path for same-service. */
    rules: AbilityRule[];
    /**
     * Raw grants (action × subject × scope) — let a downstream service re-substitute scope
     * templates with ITS OWN registry, so it can scope subjects the builder doesn't own
     * (cross-service correctness). Re-substitution reads `claims` for the `$ctx` values.
     */
    grants?: Grant[];
    /**
     * Domain context claims (consumer-defined, opaque to the SDK) — the values the builder
     * substituted into the rules, replayed onto the downstream AuthzContext so it can
     * re-substitute scope templates locally. E.g. { juridicalIndividualId, connected, … }.
     */
    claims?: Record<string, unknown>;
    /** Set when the rules blob was lz4-compressed (DEC-S4.27). Day-1: null. */
    compressed?: 'lz4' | null;
}
/**
 * Opaque snapshot id (DEC-S4.4): doesn't leak userId, idempotent per 1s build bucket.
 * blake3 in the plan; sha256 here keeps zero extra deps (opacity is what matters).
 */
export declare function computeSnapId(userId: string, tenantId: string | undefined, builtAtMs: number): string;
//# sourceMappingURL=snapshot.envelope.d.ts.map