/**
 * Zod schemas validating the on-disk policy JSON.
 *
 * Two artifacts (see docs/policy-and-guardrails.md):
 *   - the user-global workspace policy (`~/.sitecoreai/policy.json`)
 *   - the optional repo policy (`<repo>/scai.policy.json`)
 *
 * The hand-derived TypeScript shapes live in `./types`, inferred from
 * these schemas so the two can never drift.
 */
import { z } from "zod";
/** Operation risk tiers, ascending. See `./types` for the ordering helpers. */
export declare const riskTierSchema: z.ZodEnum<{
    read: "read";
    write: "write";
    destructive: "destructive";
    mint: "mint";
}>;
/** How an environment came to be enrolled — surfaced by `scai policy show`. */
export declare const enrollSourceSchema: z.ZodEnum<{
    "setup-login": "setup-login";
    "mcp-serve": "mcp-serve";
    "setup-init": "setup-init";
    "policy-init": "policy-init";
    "policy-allow": "policy-allow";
}>;
/**
 * The pinned tenant identity of an enrolled environment. Every field is
 * optional — an org-level profile has no project/environment — and
 * enforcement compares only the fields the pin actually carries.
 */
export declare const envIdentitySchema: z.ZodObject<{
    organizationId: z.ZodOptional<z.ZodString>;
    projectId: z.ZodOptional<z.ZodString>;
    environmentId: z.ZodOptional<z.ZodString>;
    host: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export declare const policyEnvironmentSchema: z.ZodObject<{
    identity: z.ZodObject<{
        organizationId: z.ZodOptional<z.ZodString>;
        projectId: z.ZodOptional<z.ZodString>;
        environmentId: z.ZodOptional<z.ZodString>;
        host: z.ZodOptional<z.ZodString>;
    }, z.core.$strip>;
    ceiling: z.ZodEnum<{
        read: "read";
        write: "write";
        destructive: "destructive";
        mint: "mint";
    }>;
    enrolledAt: z.ZodString;
    enrolledVia: z.ZodEnum<{
        "setup-login": "setup-login";
        "mcp-serve": "mcp-serve";
        "setup-init": "setup-init";
        "policy-init": "policy-init";
        "policy-allow": "policy-allow";
    }>;
    mintCredentials: z.ZodOptional<z.ZodBoolean>;
    ciWrites: z.ZodOptional<z.ZodBoolean>;
    stepUpMinutes: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
/**
 * The pinned identity of an enrolled organization — just the orgId
 * itself for now, kept as an object so future fields (region, tenant
 * triple, etc.) can be pinned without a schema migration.
 */
export declare const orgIdentitySchema: z.ZodObject<{
    organizationId: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
/**
 * One enrolled organization in the user-global workspace policy.
 * Mirrors `policyEnvironmentSchema` shape (identity + ceiling +
 * provenance) but keyed by Sitecore organization id rather than env
 * profile name. Required for brand / brief / campaign / documents /
 * pipeline / review — the org-scoped product surface — when the
 * workspace policy is in strict mode.
 */
export declare const policyOrganizationSchema: z.ZodObject<{
    identity: z.ZodObject<{
        organizationId: z.ZodOptional<z.ZodString>;
    }, z.core.$strip>;
    ceiling: z.ZodEnum<{
        read: "read";
        write: "write";
        destructive: "destructive";
        mint: "mint";
    }>;
    enrolledAt: z.ZodString;
    enrolledVia: z.ZodEnum<{
        "setup-login": "setup-login";
        "mcp-serve": "mcp-serve";
        "setup-init": "setup-init";
        "policy-init": "policy-init";
        "policy-allow": "policy-allow";
    }>;
    mintCredentials: z.ZodOptional<z.ZodBoolean>;
    ciWrites: z.ZodOptional<z.ZodBoolean>;
    stepUpMinutes: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
/** The user-global workspace policy — the hard ceiling. */
export declare const workspacePolicySchema: z.ZodObject<{
    version: z.ZodLiteral<1>;
    environments: z.ZodRecord<z.ZodString, z.ZodObject<{
        identity: z.ZodObject<{
            organizationId: z.ZodOptional<z.ZodString>;
            projectId: z.ZodOptional<z.ZodString>;
            environmentId: z.ZodOptional<z.ZodString>;
            host: z.ZodOptional<z.ZodString>;
        }, z.core.$strip>;
        ceiling: z.ZodEnum<{
            read: "read";
            write: "write";
            destructive: "destructive";
            mint: "mint";
        }>;
        enrolledAt: z.ZodString;
        enrolledVia: z.ZodEnum<{
            "setup-login": "setup-login";
            "mcp-serve": "mcp-serve";
            "setup-init": "setup-init";
            "policy-init": "policy-init";
            "policy-allow": "policy-allow";
        }>;
        mintCredentials: z.ZodOptional<z.ZodBoolean>;
        ciWrites: z.ZodOptional<z.ZodBoolean>;
        stepUpMinutes: z.ZodOptional<z.ZodNumber>;
    }, z.core.$strip>>;
    organizations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
        identity: z.ZodObject<{
            organizationId: z.ZodOptional<z.ZodString>;
        }, z.core.$strip>;
        ceiling: z.ZodEnum<{
            read: "read";
            write: "write";
            destructive: "destructive";
            mint: "mint";
        }>;
        enrolledAt: z.ZodString;
        enrolledVia: z.ZodEnum<{
            "setup-login": "setup-login";
            "mcp-serve": "mcp-serve";
            "setup-init": "setup-init";
            "policy-init": "policy-init";
            "policy-allow": "policy-allow";
        }>;
        mintCredentials: z.ZodOptional<z.ZodBoolean>;
        ciWrites: z.ZodOptional<z.ZodBoolean>;
        stepUpMinutes: z.ZodOptional<z.ZodNumber>;
    }, z.core.$strip>>>;
    strictOrgs: z.ZodOptional<z.ZodBoolean>;
}, z.core.$strip>;
/**
 * The optional repo policy. May only NARROW the workspace policy — drop
 * environments from the allowlist, lower ceilings — never widen.
 */
export declare const repoPolicySchema: z.ZodObject<{
    version: z.ZodLiteral<1>;
    allowEnvironments: z.ZodOptional<z.ZodArray<z.ZodString>>;
    environments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
        ceiling: z.ZodOptional<z.ZodEnum<{
            read: "read";
            write: "write";
            destructive: "destructive";
            mint: "mint";
        }>>;
        mintCredentials: z.ZodOptional<z.ZodBoolean>;
        ciWrites: z.ZodOptional<z.ZodBoolean>;
        stepUpMinutes: z.ZodOptional<z.ZodNumber>;
    }, z.core.$strip>>>;
    allowOrganizations: z.ZodOptional<z.ZodArray<z.ZodString>>;
    organizations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
        ceiling: z.ZodOptional<z.ZodEnum<{
            read: "read";
            write: "write";
            destructive: "destructive";
            mint: "mint";
        }>>;
        mintCredentials: z.ZodOptional<z.ZodBoolean>;
        ciWrites: z.ZodOptional<z.ZodBoolean>;
        stepUpMinutes: z.ZodOptional<z.ZodNumber>;
    }, z.core.$strip>>>;
}, z.core.$strip>;
export declare const parseWorkspacePolicy: (raw: unknown, source: string) => {
    version: 1;
    environments: Record<string, {
        identity: {
            organizationId?: string | undefined;
            projectId?: string | undefined;
            environmentId?: string | undefined;
            host?: string | undefined;
        };
        ceiling: "read" | "write" | "destructive" | "mint";
        enrolledAt: string;
        enrolledVia: "setup-login" | "mcp-serve" | "setup-init" | "policy-init" | "policy-allow";
        mintCredentials?: boolean | undefined;
        ciWrites?: boolean | undefined;
        stepUpMinutes?: number | undefined;
    }>;
    organizations?: Record<string, {
        identity: {
            organizationId?: string | undefined;
        };
        ceiling: "read" | "write" | "destructive" | "mint";
        enrolledAt: string;
        enrolledVia: "setup-login" | "mcp-serve" | "setup-init" | "policy-init" | "policy-allow";
        mintCredentials?: boolean | undefined;
        ciWrites?: boolean | undefined;
        stepUpMinutes?: number | undefined;
    }> | undefined;
    strictOrgs?: boolean | undefined;
};
export declare const parseRepoPolicy: (raw: unknown, source: string) => {
    version: 1;
    allowEnvironments?: string[] | undefined;
    environments?: Record<string, {
        ceiling?: "read" | "write" | "destructive" | "mint" | undefined;
        mintCredentials?: boolean | undefined;
        ciWrites?: boolean | undefined;
        stepUpMinutes?: number | undefined;
    }> | undefined;
    allowOrganizations?: string[] | undefined;
    organizations?: Record<string, {
        ceiling?: "read" | "write" | "destructive" | "mint" | undefined;
        mintCredentials?: boolean | undefined;
        ciWrites?: boolean | undefined;
        stepUpMinutes?: number | undefined;
    }> | undefined;
};