import type { SelectedSecretBindings } from "./execution-secrets.js";
export declare const MAX_EXECUTION_GRANTS = 256;
export declare const MAX_EXECUTION_GRANT_BYTES: number;
export interface ExecutionGrant {
    id: string;
    target: "local";
    selection: {
        slug: string;
        version: string;
        bundleDigest: string;
    };
    actors: string[];
    /** Canonical directory conditions, not cryptographic machine attestation. */
    consumers: {
        stationId: string;
        workspaceDirectory: string;
        includeDescendants?: boolean;
    }[];
    secretsAuthority: string;
    bindings: Record<string, string>;
    expiresAt?: string;
}
export interface ExecutionGrantPolicy {
    schema: "hasna.skills-execution-grants.v1";
    profileId: string;
    workspaceId: string;
    revision: string;
    previousRevision: string | null;
    updatedAt: string;
    actorId: string;
    grants: ExecutionGrant[];
}
export interface ExecutionGrantRequest {
    selection: SelectedSecretBindings["selection"];
    consumer: SelectedSecretBindings["consumer"];
}
export interface ResolvedExecutionGrant {
    policyRevision: string;
    grantId: string;
    bindings: SelectedSecretBindings;
}
export declare function grantIdentifier(v: unknown): v is string;
export declare function grantRecord(v: unknown): v is Record<string, unknown>;
export declare function grantWorkspace(v: unknown): v is string;
export declare function grantDirectoryContains(root: string, directory: string, descendants?: boolean): boolean;
export declare function validateExecutionGrants(value: unknown): ExecutionGrant[];
export declare function validateExecutionGrantPolicy(value: unknown): ExecutionGrantPolicy;
export declare function validateExecutionGrantRequest(value: unknown): ExecutionGrantRequest;
export declare function executionGrantMatches(g: ExecutionGrant, r: ExecutionGrantRequest, actorId: string, now?: number): boolean;