import { MemoryIdentityStore } from './identity-store.js';
import type { DurableStateAdapter } from '../durable/file-journal.js';
import type { ScopedIdempotency } from '../durable/types.js';
import type { DurableIdentityStore } from './identity-store.js';
import type { ConnectorGrant, ContentGrant, PolicyAuditEvent, ProjectRoleMutationRequest, ConnectorCapabilityMutationRequest, StudioAdminBootstrapRequest, StudioAdminBootstrapResult, StudioAdminGrantRequest, StudioRoleGrant, StudioRoleMutationRequest } from './types.js';
export interface MemoryPolicySeed {
    projects?: readonly string[];
    contentGrants?: readonly ContentGrant[];
    connectorGrants?: readonly ConnectorGrant[];
}
export declare class MemoryPolicyStore {
    #private;
    constructor(seed?: MemoryPolicySeed);
    get auditEvents(): PolicyAuditEvent[];
    hasProject(projectId: string): boolean;
    getContentGrants(projectId: string, personId: string): ContentGrant[];
    hasConnectorGrant(projectId: string, personId: string, capability: string): boolean;
    applyContentRoleMutation(identities: MemoryIdentityStore, operation: 'grant' | 'revoke', request: ProjectRoleMutationRequest): {
        status: 'applied';
        personId: string;
    } | {
        status: 'denied';
        reasonCode: string;
    };
    applyConnectorCapabilityMutation(identities: MemoryIdentityStore, knownCapabilities: ReadonlySet<string>, operation: 'grant' | 'revoke', request: ConnectorCapabilityMutationRequest): {
        status: 'applied';
        personId: string;
    } | {
        status: 'denied';
        reasonCode: string;
    };
    listStudioAdmins(): string[];
    isStudioAdmin(personId: string): boolean;
    listStudioRoleGrants(): StudioRoleGrant[];
    hasStudioRole(personId: string, role: StudioRoleGrant['role']): boolean;
    studioAuthorizationRevision(personId: string): number;
    isBootstrapClosed(): boolean;
    bootstrapStudioAdmin(identities: MemoryIdentityStore, request: StudioAdminBootstrapRequest): StudioAdminBootstrapResult;
    applyStudioAdminMutation(identities: MemoryIdentityStore, operation: 'grant' | 'revoke', request: StudioAdminGrantRequest): {
        status: 'applied';
        personId: string;
    } | {
        status: 'denied';
        reasonCode: string;
    };
    applyStudioRoleMutation(identities: MemoryIdentityStore, operation: 'grant' | 'revoke', request: StudioRoleMutationRequest): {
        status: 'applied';
        personId: string;
    } | {
        status: 'denied';
        reasonCode: string;
    };
}
type PolicyMutationResult = {
    status: 'applied';
    personId: string;
} | {
    status: 'denied';
    reasonCode: string;
};
export declare class DurablePolicyStore {
    readonly adapter: DurableStateAdapter;
    constructor(adapter: DurableStateAdapter);
    seedProjects(projects: readonly string[], idempotency: ScopedIdempotency, occurredAt: string): Promise<'committed' | 'duplicate' | 'conflict'>;
    bootstrapStudioAdmin(identities: DurableIdentityStore, request: StudioAdminBootstrapRequest, idempotency: ScopedIdempotency): Promise<StudioAdminBootstrapResult>;
    decide(request: import('./types.js').AccessRequest, knownCapabilities: ReadonlySet<string>, minimumActions: ReadonlyMap<string, 'read' | 'write'>): import('./types.js').PolicyDecision;
    decideStudio(request: import('./types.js').StudioAccessRequest): import('./types.js').PolicyDecision;
    studioAuthorizationRevision(personId: string): number;
    applyContentRoleMutation(identities: DurableIdentityStore, operation: 'grant' | 'revoke', request: ProjectRoleMutationRequest, idempotency: ScopedIdempotency): Promise<PolicyMutationResult>;
    applyConnectorCapabilityMutation(identities: DurableIdentityStore, knownCapabilities: ReadonlySet<string>, operation: 'grant' | 'revoke', request: ConnectorCapabilityMutationRequest, idempotency: ScopedIdempotency): Promise<PolicyMutationResult>;
    applyStudioAdminMutation(identities: DurableIdentityStore, operation: 'grant' | 'revoke', request: StudioAdminGrantRequest, idempotency: ScopedIdempotency): Promise<PolicyMutationResult>;
    applyStudioRoleMutation(identities: DurableIdentityStore, operation: 'grant' | 'revoke', request: StudioRoleMutationRequest, idempotency: ScopedIdempotency): Promise<PolicyMutationResult>;
}
export {};