export type JITAccessRequest = {
    principal: string;
    requestId: string;
    role: string;
    requestedAt: Date;
    expiresAt: Date;
    justification: string;
};
export type JITAccessGrant = {
    requestId: string;
    principal: string;
    role: string;
    grantedAt: Date;
    expiresAt: Date;
    approvers: string[];
};
export type ManagedIdentity = {
    id: string;
    name: string;
    principal: string;
    createdAt: Date;
    metadata?: Record<string, unknown>;
};
/**
 * Just-in-time access and managed identity management
 * Phase 2: JIT access control with approval workflows
 */
export declare class JITAccessManager {
    private readonly jitRequests;
    private readonly jitGrants;
    private readonly managedIdentities;
    private readonly pendingApprovals;
    /**
     * Request just-in-time access
     */
    requestAccess(request: JITAccessRequest): string;
    /**
     * Get access request
     */
    getAccessRequest(requestId: string): JITAccessRequest | undefined;
    /**
     * List pending access requests
     */
    listPendingRequests(): JITAccessRequest[];
    /**
     * Approve access request (requires approval from reviewer)
     */
    approveAccess(requestId: string, approver: string): boolean;
    /**
     * Reject access request
     */
    rejectAccess(requestId: string): void;
    /**
     * Check if principal has active access
     */
    hasActiveAccess(principal: string, role: string): boolean;
    /**
     * Get active grants for principal
     */
    getActiveGrants(principal: string): JITAccessGrant[];
    /**
     * Revoke access grant
     */
    revokeGrant(requestId: string): void;
    /**
     * Register a managed identity
     */
    registerManagedIdentity(identity: ManagedIdentity): void;
    /**
     * Get managed identity
     */
    getManagedIdentity(identityId: string): ManagedIdentity | undefined;
    /**
     * List all managed identities
     */
    listManagedIdentities(): ManagedIdentity[];
    /**
     * Unregister managed identity
     */
    unregisterManagedIdentity(identityId: string): void;
    /**
     * Require MFA for access grant (metadata flag)
     */
    requireMFAForGrant(requestId: string): void;
    /**
     * Clean up expired grants
     */
    cleanupExpiredGrants(): number;
}
//# sourceMappingURL=jit-access.d.ts.map