export type IdentityProvider = 'github' | 'slack' | 'email' | 'runtime';
export type BindingStatus = 'verified' | 'revoked';
export type ProjectRole = 'maintain' | 'write' | 'read' | 'no_access';
export type ProjectAction = 'read' | 'write' | 'manage_members' | 'connector';
export type StudioRole = 'manager';
export type StudioAction = 'improve';
export type PolicyEffect = 'allow' | 'deny';
export type PolicyMode = 'enforce' | 'shadow';
export interface Person {
    personId: string;
}
export interface IdentitySubject {
    provider: IdentityProvider;
    subject: string;
}
export interface IdentityBinding extends IdentitySubject {
    bindingId: string;
    personId: string;
    status: BindingStatus;
    verifiedAt: string;
    revokedAt?: string;
}
export interface ActorRef {
    kind: string;
    id: string;
}
export interface ContentGrant {
    projectId: string;
    personId: string;
    role: ProjectRole;
}
export interface ConnectorGrant {
    projectId: string;
    personId: string;
    capability: string;
}
export interface StudioRoleGrant {
    personId: string;
    role: StudioRole;
}
export interface AccessRequest {
    subject: IdentitySubject;
    projectId: string;
    action: ProjectAction;
    connectorCapability?: string;
}
export interface StudioAccessRequest {
    subject: IdentitySubject;
    action: StudioAction;
}
export interface GrantRequest {
    subject: IdentitySubject;
    projectId: string;
    targetRole: ProjectRole;
}
export interface StudioAdminGrantRequest {
    subject: IdentitySubject;
    target: IdentitySubject;
    occurredAt: string;
}
export interface StudioAdminRevokeRequest extends StudioAdminGrantRequest {
}
export interface StudioRoleMutationRequest extends StudioAdminGrantRequest {
    role: StudioRole;
}
export interface ProjectRoleMutationRequest extends StudioAdminGrantRequest {
    projectId: string;
    role: ProjectRole;
}
export interface ConnectorCapabilityMutationRequest extends StudioAdminGrantRequest {
    projectId: string;
    capability: string;
}
export interface StudioAdminBootstrapRequest {
    source: 'administrative' | 'installation';
    subject: IdentitySubject;
    actor: ActorRef;
    occurredAt: string;
}
export type StudioAdminBootstrapResult = {
    status: 'bootstrapped';
    personId: string;
} | {
    status: 'denied';
    reasonCode: string;
};
export interface PolicyDecision {
    policyEffect: PolicyEffect;
    reasonCodes: string[];
    matchedRuleIds: string[];
}
export interface AuthorizationResult extends PolicyDecision {
    proceed: boolean;
    nonEnforcing: boolean;
}
declare const authorizationEvidenceBrand: unique symbol;
export interface AuthorizationEvidence {
    readonly [authorizationEvidenceBrand]: true;
}
declare const authorizationAudienceBrand: unique symbol;
export interface AuthorizationAudience {
    readonly [authorizationAudienceBrand]: true;
}
export interface AuthorizationEvidenceReference {
    readonly authorizationId: string;
    readonly requestId: string;
    readonly projectId: string;
    readonly action: ProjectAction;
    readonly policyEffect: 'allow';
    readonly matchedRuleIds: readonly string[];
    readonly issuedAt: string;
    readonly bindingDigest?: string;
}
export interface AuthorizationEvidenceContext {
    readonly mode: PolicyMode;
    readonly authorizationId: string;
    readonly requestId: string;
    readonly issuedAt: string;
    readonly audience: AuthorizationAudience;
    readonly bindingDigest?: string;
}
export interface AuthorizationEvidenceExpectation {
    readonly projectId: string;
    readonly action: ProjectAction;
    readonly requestId: string;
    readonly subject: IdentitySubject;
    readonly connectorCapability?: string;
    readonly evidenceCategory?: string;
    readonly bindingDigest?: string;
}
export interface VerifiedAuthorization {
    readonly reference: AuthorizationEvidenceReference;
    readonly personId: string;
}
export interface AuthorizationVerifier {
    readonly audience: AuthorizationAudience;
    readonly verify: (evidence: unknown, expectation: AuthorizationEvidenceExpectation) => VerifiedAuthorization;
}
export type EvidenceAuthorizationResult = {
    readonly status: 'authorized';
    readonly evidence: AuthorizationEvidence;
    readonly reference: AuthorizationEvidenceReference;
    readonly decision: PolicyDecision;
} | {
    readonly status: 'denied';
    readonly decision: PolicyDecision;
};
export interface PolicyAuthorizationEngine {
    createAuthorizationVerifier(): AuthorizationVerifier;
    authorizeWithEvidence(request: AccessRequest, context: AuthorizationEvidenceContext): EvidenceAuthorizationResult;
    releaseAuthorizationEvidence(evidence: unknown): void;
}
declare const studioAuthorizationEvidenceBrand: unique symbol;
export interface StudioAuthorizationEvidence {
    readonly [studioAuthorizationEvidenceBrand]: true;
}
declare const studioAuthorizationAudienceBrand: unique symbol;
export interface StudioAuthorizationAudience {
    readonly [studioAuthorizationAudienceBrand]: true;
}
export interface StudioAuthorizationEvidenceReference {
    readonly authorizationId: string;
    readonly requestId: string;
    readonly action: StudioAction;
    readonly policyEffect: 'allow';
    readonly matchedRuleIds: readonly string[];
    readonly issuedAt: string;
    readonly bindingDigest?: string;
}
export interface StudioAuthorizationEvidenceContext {
    readonly mode: PolicyMode;
    readonly authorizationId: string;
    readonly requestId: string;
    readonly issuedAt: string;
    readonly audience: StudioAuthorizationAudience;
    readonly bindingDigest?: string;
}
export interface StudioAuthorizationEvidenceExpectation {
    readonly action: StudioAction;
    readonly requestId: string;
    readonly subject: IdentitySubject;
    readonly bindingDigest?: string;
}
export interface VerifiedStudioAuthorization {
    readonly reference: StudioAuthorizationEvidenceReference;
    readonly personId: string;
}
export interface StudioAuthorizationVerifier {
    readonly audience: StudioAuthorizationAudience;
    readonly verify: (evidence: unknown, expectation: StudioAuthorizationEvidenceExpectation) => VerifiedStudioAuthorization;
}
export type StudioEvidenceAuthorizationResult = {
    readonly status: 'authorized';
    readonly evidence: StudioAuthorizationEvidence;
    readonly reference: StudioAuthorizationEvidenceReference;
    readonly decision: PolicyDecision;
} | {
    readonly status: 'denied';
    readonly decision: PolicyDecision;
};
export interface PolicyAuditEvent {
    eventId: string;
    type: 'studio_admin.bootstrapped' | 'studio_admin.granted' | 'studio_admin.revoked' | 'studio_role.granted' | 'studio_role.revoked' | 'content_role.granted' | 'content_role.revoked' | 'connector.granted' | 'connector.revoked';
    actor: ActorRef;
    personId: string;
    occurredAt: string;
    projectId?: string;
    role?: ProjectRole | StudioRole;
    capability?: string;
}
export {};