export interface IToken {
    token: string;
    expiresAt: number;
    assignedRoles: string[];
}
export type TServiceDeploymentCapability = 'deployment:preflight' | 'deployment:reserve' | 'deployment:registry-push' | 'deployment:release-read' | 'deployment:promote-image' | 'deployment:adopt-existing' | 'deployment:status' | 'deployment:create-greenfield' | 'deployment:promote-route' | 'deployment:rollback-image' | 'deployment:rollback-route' | 'deployment:retry' | 'deployment:cleanup';
/**
 * Server-persisted authority for one logical service. These grants are never
 * accepted from the identity payload supplied by a caller; Cloudly reloads
 * the owning user from the verified JWT before evaluating them.
 */
interface IServiceDeploymentGrantBase {
    organizationId: string;
    serviceId: string;
    capabilities: TServiceDeploymentCapability[];
}
/** Authority over one service that already exists and has the same owner. */
export interface IExistingServiceDeploymentGrant extends IServiceDeploymentGrantBase {
    scope: 'service';
}
/** Authority to create one exact, not-yet-existing service ID in an organization. */
export interface IOrganizationServiceSlotDeploymentGrant extends IServiceDeploymentGrantBase {
    scope: 'organization-service-slot';
}
export type IServiceDeploymentGrant = IExistingServiceDeploymentGrant | IOrganizationServiceSlotDeploymentGrant;
export declare const validateServiceDeploymentGrant: (grantArg: unknown) => string[];
export interface IIdentityCredential {
    jwt: string;
}
/**
 * an identity is assumed by authentication as a user
 * an identity is ephemeral and has to be renewed regularly
 */
export interface IIdentity extends IIdentityCredential {
    name: string;
    userId: string;
    type: 'machine' | 'human';
    role: 'admin' | 'user' | 'api' | 'cluster';
    expiresAt: number;
}
export interface IUser {
    id: string;
    data: {
        type: 'machine' | 'human';
        role: 'admin' | 'user' | 'api' | 'cluster';
        username?: string;
        password?: string;
        tokens?: IToken[];
        serviceDeploymentGrants?: IServiceDeploymentGrant[];
    };
}
export {};