export declare const agentEffects: readonly ["project-read", "project-write", "repository-read", "repository-write", "safe-command-execution", "web-read", "browser-verification", "figma-read", "figma-write", "agent-spawn"];
export type AgentEffect = typeof agentEffects[number];
export type ProjectAction = 'read' | 'write';
export declare const projectGrantPaths: readonly ["brief.md", "ds-tokens.html", "ds-guide.md", "ds-status.md", "artifacts/ads", "artifacts/product", "artifacts/references", "artifacts/3-canvas", "artifacts/7-html-prototype"];
export type ProjectGrantPath = typeof projectGrantPaths[number];
export declare const repositoryGrantTargets: readonly ["root", "learning-file", "component-paths", "page-paths"];
export type RepositoryGrantTarget = typeof repositoryGrantTargets[number];
export declare const figmaGrantTargets: readonly ["selection", "frame", "page", "board"];
export type FigmaGrantTarget = typeof figmaGrantTargets[number];
export declare const commandPolicies: readonly ["repository-validation-readonly"];
export type CommandPolicy = typeof commandPolicies[number];
export type AgentGrantTemplate = {
    readonly kind: 'project-path';
    readonly access: 'write';
    readonly path: ProjectGrantPath;
    readonly recursive: boolean;
} | {
    readonly kind: 'repository';
    readonly access: 'read' | 'write';
    readonly target: RepositoryGrantTarget;
} | {
    readonly kind: 'figma';
    readonly access: 'read' | 'write';
    readonly target: FigmaGrantTarget;
} | {
    readonly kind: 'command';
    readonly access: 'execute';
    readonly policy: CommandPolicy;
};
export interface AgentPermissionContract {
    readonly projectAction: ProjectAction;
    readonly effects: readonly AgentEffect[];
    readonly grants: readonly AgentGrantTemplate[];
    readonly spawnTargets: readonly string[];
    readonly queryProfileId: string;
    readonly queryProfileSha256: string;
}
export interface TrustedRepositoryGrantContext {
    readonly root: string;
    readonly componentPaths?: readonly string[];
    readonly pagePaths?: readonly string[];
}
export interface TrustedFigmaGrantContext {
    readonly fileKey: string;
    readonly nodeId: string;
    readonly nodeKind: 'frame' | 'page' | 'board' | 'node';
}
export interface TrustedCommandGrantContext {
    readonly executable: 'npm' | 'npm.cmd' | 'pnpm' | 'pnpm.cmd' | 'yarn' | 'yarn.cmd';
    readonly argv: readonly string[];
    readonly cwd: string;
    readonly env: Readonly<Record<string, string>>;
    readonly readOnlyFileSystem: true;
}
export interface TrustedGrantContext {
    readonly repository?: TrustedRepositoryGrantContext;
    readonly figma?: TrustedFigmaGrantContext;
    readonly command?: TrustedCommandGrantContext;
}
export type ResolvedAgentGrant = {
    readonly kind: 'project-path';
    readonly access: 'write';
    readonly projectId: string;
    readonly path: ProjectGrantPath;
    readonly recursive: boolean;
} | {
    readonly kind: 'repository-root';
    readonly access: 'read';
    readonly root: string;
} | {
    readonly kind: 'repository-path';
    readonly access: 'read' | 'write';
    readonly root: string;
    readonly path: string;
} | {
    readonly kind: 'figma-node';
    readonly access: 'read' | 'write';
    readonly connectorCapability: 'figma.read' | 'figma.write';
    readonly fileKey: string;
    readonly nodeId: string;
    readonly nodeKind: TrustedFigmaGrantContext['nodeKind'];
} | {
    readonly kind: 'command';
    readonly access: 'execute';
    readonly policy: CommandPolicy;
    readonly executable: TrustedCommandGrantContext['executable'];
    readonly argv: readonly string[];
    readonly cwd: string;
    readonly env: Readonly<Record<string, string>>;
    readonly fileSystem: 'read-only';
};
interface ResolvedGrantBindingBase {
    readonly targetAgentId: string;
    readonly requestId: string;
    readonly identity: {
        readonly provider: string;
        readonly subject: string;
    };
    readonly permissionDigest: string;
    readonly grants: readonly ResolvedAgentGrant[];
}
export type ResolvedGrantBinding = ResolvedGrantBindingBase & ({
    readonly projectId: string;
    readonly studioAction?: never;
} | {
    readonly studioAction: 'improve';
    readonly projectId?: never;
});
export declare function parseTrustedGrantContext(value: unknown): TrustedGrantContext | null;
export declare function permissionDigest(permission: AgentPermissionContract): string;
export declare function freezePermission(permission: AgentPermissionContract): AgentPermissionContract;
export declare function resolveAgentGrants(permission: AgentPermissionContract, context: TrustedGrantContext, projectId: string): readonly ResolvedAgentGrant[] | null;
export declare function resolveStudioAgentGrants(permission: AgentPermissionContract, context: TrustedGrantContext): readonly ResolvedAgentGrant[] | null;
export declare function resolvedGrantDigest(binding: ResolvedGrantBinding): string;
export {};