import { MemoryIdentityStore } from './identity-store.js';
import { MemoryPolicyStore } from './policy-store.js';
import { DurableIdentityStore } from './identity-store.js';
import { DurablePolicyStore } from './policy-store.js';
import type { ScopedIdempotency } from '../durable/types.js';
import type { AccessRequest, AuthorizationEvidenceContext, AuthorizationVerifier, ConnectorCapabilityMutationRequest, EvidenceAuthorizationResult, GrantRequest, PolicyDecision, ProjectRoleMutationRequest, StudioAdminGrantRequest, StudioAdminRevokeRequest, StudioAccessRequest, StudioAuthorizationEvidenceContext, StudioAuthorizationVerifier, StudioEvidenceAuthorizationResult, StudioRoleMutationRequest } from './types.js';
export declare class PolicyEngine {
    #private;
    readonly identities: MemoryIdentityStore;
    readonly policies: MemoryPolicyStore;
    readonly knownConnectorCapabilities: ReadonlySet<string>;
    constructor(identities: MemoryIdentityStore, policies: MemoryPolicyStore, knownConnectorCapabilities?: ReadonlySet<string>);
    createAuthorizationVerifier(): AuthorizationVerifier;
    createStudioAuthorizationVerifier(): StudioAuthorizationVerifier;
    decide(request: AccessRequest): PolicyDecision;
    decideStudio(request: StudioAccessRequest): PolicyDecision;
    authorizeStudioWithEvidence(request: StudioAccessRequest, context: StudioAuthorizationEvidenceContext): StudioEvidenceAuthorizationResult;
    authorizeWithEvidence(request: AccessRequest, context: AuthorizationEvidenceContext): EvidenceAuthorizationResult;
    releaseAuthorizationEvidence(evidence: unknown): void;
    releaseStudioAuthorizationEvidence(evidence: unknown): void;
    decideGrant(request: GrantRequest): PolicyDecision;
    grantStudioAdmin(request: StudioAdminGrantRequest): PolicyDecision;
    revokeStudioAdmin(request: StudioAdminRevokeRequest): PolicyDecision;
    grantStudioRole(request: StudioRoleMutationRequest): PolicyDecision;
    revokeStudioRole(request: StudioRoleMutationRequest): PolicyDecision;
    grantProjectRole(request: ProjectRoleMutationRequest): PolicyDecision;
    revokeProjectRole(request: ProjectRoleMutationRequest): PolicyDecision;
    grantConnectorCapability(request: ConnectorCapabilityMutationRequest): PolicyDecision;
    revokeConnectorCapability(request: ConnectorCapabilityMutationRequest): PolicyDecision;
}
/** Restart-safe policy facade. Every authorization read replays the authoritative journal. */
export declare class DurablePolicyEngine {
    #private;
    readonly identities: DurableIdentityStore;
    readonly policies: DurablePolicyStore;
    readonly knownConnectorCapabilities: ReadonlySet<string>;
    constructor(identities: DurableIdentityStore, policies: DurablePolicyStore, knownConnectorCapabilities?: ReadonlySet<string>);
    decide(request: AccessRequest): PolicyDecision;
    decideStudio(request: StudioAccessRequest): PolicyDecision;
    createAuthorizationVerifier(): AuthorizationVerifier;
    createStudioAuthorizationVerifier(): StudioAuthorizationVerifier;
    authorizeWithEvidence(request: AccessRequest, context: AuthorizationEvidenceContext): EvidenceAuthorizationResult;
    authorizeStudioWithEvidence(request: StudioAccessRequest, context: StudioAuthorizationEvidenceContext): StudioEvidenceAuthorizationResult;
    releaseAuthorizationEvidence(evidence: unknown): void;
    releaseStudioAuthorizationEvidence(evidence: unknown): void;
    grantProjectRole(request: ProjectRoleMutationRequest, idempotency: ScopedIdempotency): Promise<PolicyDecision>;
    revokeProjectRole(request: ProjectRoleMutationRequest, idempotency: ScopedIdempotency): Promise<PolicyDecision>;
    grantConnectorCapability(request: ConnectorCapabilityMutationRequest, idempotency: ScopedIdempotency): Promise<PolicyDecision>;
    revokeConnectorCapability(request: ConnectorCapabilityMutationRequest, idempotency: ScopedIdempotency): Promise<PolicyDecision>;
    grantStudioAdmin(request: StudioAdminGrantRequest, idempotency: ScopedIdempotency): Promise<PolicyDecision>;
    revokeStudioAdmin(request: StudioAdminRevokeRequest, idempotency: ScopedIdempotency): Promise<PolicyDecision>;
    grantStudioRole(request: StudioRoleMutationRequest, idempotency: ScopedIdempotency): Promise<PolicyDecision>;
    revokeStudioRole(request: StudioRoleMutationRequest, idempotency: ScopedIdempotency): Promise<PolicyDecision>;
}