import { z } from 'zod';
export declare const node: z.ZodObject<{
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
}, z.core.$strip>;
export type Node = z.infer<typeof node>;
export declare const roleKey: z.ZodString;
export declare const roleDefinition: z.ZodObject<{
    key: z.ZodString;
    permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
    source: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.ZodLiteral<"vertical">]>;
}, z.core.$strip>;
export type RoleDefinition = z.infer<typeof roleDefinition>;
/**
 * A role as the directory holds it — the definition plus the tenant it belongs
 * to (control-plane.md §4.5's roles surface). `RoleDefinition` is what a caller
 * AUTHORS, and a tenant is ambient at that point (`defineRole(actor, tenantId,
 * role)`); this is what a caller READS back, where the tenant is the answer to
 * "where does this role apply?" and has to travel with it.
 */
export declare const tenantRole: z.ZodObject<{
    key: z.ZodString;
    permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
    source: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.ZodLiteral<"vertical">]>;
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
}, z.core.$strip>;
export type TenantRole = z.infer<typeof tenantRole>;
export declare const roleAssignment: z.ZodObject<{
    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
    roleKey: z.ZodString;
    node: z.ZodObject<{
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    }, z.core.$strip>;
}, z.core.$strip>;
export type RoleAssignment = z.infer<typeof roleAssignment>;
/**
 * Who is being checked (#97).
 *
 * The model already had more than one kind of subject — a principal, and the
 * orgs it belongs to via membership. This makes the ENTRY subject polymorphic
 * too, so a connection can hold a grant without pretending to be a person.
 *
 * The alternative was to mint a principal per connection and let it flow
 * through unchanged, which is cheaper and wrong: every audit view would then
 * show a `principal:` subject for something that is not one, which is exactly
 * the confusion `PlatformActorId`'s separate brand exists to prevent.
 */
export declare const checkSubject: z.ZodUnion<readonly [z.ZodObject<{
    kind: z.ZodLiteral<"principal">;
    id: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
}, z.core.$strip>, z.ZodObject<{
    kind: z.ZodLiteral<"connection">;
    id: z.ZodString;
}, z.core.$strip>, z.ZodObject<{
    kind: z.ZodLiteral<"system">;
    id: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
}, z.core.$strip>]>;
export type CheckSubject = z.infer<typeof checkSubject>;
/** The tuple-store ref for a subject: `principal:01J…` / `connection:01J…` / `system:@scope/mod`. */
export declare const subjectRef: (subject: CheckSubject) => string;
/**
 * A capability granted to a CONNECTION rather than a principal (#97).
 *
 * Narrow by construction: a connection is keyed (tenant, vertical, provider),
 * so granting it `protocol:record-signature` reaches only that tenant's scopes
 * running that vertical. The blast radius of a leaked provider token is one
 * permission on one vertical's data, and it is readable in a diff.
 */
export declare const connectionGrant: z.ZodObject<{
    connectionId: z.ZodString;
    permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
    node: z.ZodObject<{
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    }, z.core.$strip>;
    expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    grantedBy: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
}, z.core.$strip>;
export type ConnectionGrant = z.infer<typeof connectionGrant>;
/**
 * A connection grant as the DIRECTORY records it (#592) — the durable, readable half
 * of `grantToConnection`, written alongside the enforcement tuple. The tuple lives
 * where it is checked (the scope's own store); this row is what the platform gathers
 * FROM, so a scope provisioned after the grant receives the same grants as one
 * provisioned before it, and so "what may this connection invoke" is answerable
 * without walking every scope DO (connections.md §6.2.4). Tombstoned (never deleted)
 * by `revokeConnection`'s cascade — a revoked row is evidence, not roster.
 */
export declare const connectionGrantRecord: z.ZodObject<{
    connectionId: z.ZodString;
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    vertical: z.ZodString;
    permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    grantedBy: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
    grantedAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
    revokedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
}, z.core.$strip>;
export type ConnectionGrantRecord = z.infer<typeof connectionGrantRecord>;
/**
 * A connection grant as it travels INTO a deployment (#592) — delivered with
 * provision/reconcile exactly as entitlements (#310) and identity links (#406) are,
 * and projected as the scope-local `connection:<id>` tuple the permission checker
 * reads. Already materialized to ONE scope, so it carries no node; the platform is
 * the authoritative source (it gathers from the directory, never the caller's body),
 * and only LIVE grants of LIVE connections are ever delivered — a revoked
 * connection's grants are simply absent from the next delivery.
 */
export declare const projectedConnectionGrant: z.ZodObject<{
    connectionId: z.ZodString;
    permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
    expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
}, z.core.$strip>;
export type ProjectedConnectionGrant = z.infer<typeof projectedConnectionGrant>;
export declare const capabilityGrant: z.ZodObject<{
    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
    permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
    node: z.ZodObject<{
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    }, z.core.$strip>;
    entity: z.ZodOptional<z.ZodObject<{
        entityType: z.ZodString;
        entityId: z.ZodString;
    }, z.core.$strip>>;
    expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    grantedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
}, z.core.$strip>;
export type CapabilityGrant = z.infer<typeof capabilityGrant>;
/**
 * A capability granted to a MODULE's system principal rather than a person (#383) —
 * the scheduler analogue of `connectionGrant`.
 *
 * Narrow by construction: it reaches only scopes of the module it names, and only
 * the one permission. It is projected from the module's declared `schedules`
 * (`scheduleSpec.permissions`) at scope provisioning, so what a schedule may do is
 * both readable in the permission diff (code) and revocable per scope (runtime — a
 * revoke fails the operation's own `ctx.check` closed, which is how scheduling is
 * disabled for a tenant without a special "off" code path).
 */
export declare const systemGrant: z.ZodObject<{
    moduleId: z.core.$ZodBranded<z.ZodString, "ModuleId", "out">;
    permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
    node: z.ZodObject<{
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    }, z.core.$strip>;
    expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    grantedBy: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
}, z.core.$strip>;
export type SystemGrant = z.infer<typeof systemGrant>;
export declare const objectRef: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
export type ObjectRef = z.infer<typeof objectRef>;
export declare const relationName: z.ZodString;
export declare const relationTuple: z.ZodObject<{
    subject: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
    relation: z.ZodString;
    object: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
}, z.core.$strip>;
export type RelationTuple = z.infer<typeof relationTuple>;
export declare const decision: z.ZodDiscriminatedUnion<[z.ZodObject<{
    allowed: z.ZodLiteral<true>;
    proof: z.ZodArray<z.ZodObject<{
        subject: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
        relation: z.ZodString;
        object: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
    }, z.core.$strip>>;
}, z.core.$strip>, z.ZodObject<{
    allowed: z.ZodLiteral<false>;
    checked: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
    node: z.ZodObject<{
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    }, z.core.$strip>;
}, z.core.$strip>], "allowed">;
export type Decision = z.infer<typeof decision>;
/**
 * The answer to §5.1's bound: may this subject confer this set of permissions?
 *
 * **Not a `Decision`, deliberately.** A `Decision` answers about ONE permission and
 * carries a proof, and this asks about a set — so an allow would need N proofs and a
 * refusal would have to pick one permission to name. What a caller actually needs on a
 * refusal is *which* permissions are missing, because that is the sentence a person can
 * act on: "you cannot assign `owner` — you do not hold `billing:manage`".
 *
 * `missing` is empty if and only if `covered`, and is ordered as the request was so an
 * error message reads predictably. That is a **discriminated union rather than a
 * sentence**, for the same reason `Decision` above is one: written as
 * `{ covered: boolean; missing: PermissionKey[] }`, a `covered: true` carrying names in
 * `missing` type-checks and parses, and the caller that reads `covered` and the caller
 * that reads `missing` get opposite answers about the same bound — a refusal that reads
 * as an allow. A producer must now commit to one side, and an empty `missing` beside a
 * `covered: false` is unrepresentable too.
 */
export declare const coverage: z.ZodDiscriminatedUnion<[z.ZodObject<{
    covered: z.ZodLiteral<true>;
    missing: z.ZodTuple<[], null>;
}, z.core.$strip>, z.ZodObject<{
    covered: z.ZodLiteral<false>;
    missing: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
}, z.core.$strip>], "covered">;
export type Coverage = z.infer<typeof coverage>;
/**
 * The grant an allow resolved through (K-34), for stamping onto an emitted event's
 * `authorization`. Every allow proof ends with a `granted:<permission>` tuple, but a ROLE
 * expansion's has subject `role:<key>` while a capability grant's has a principal / org /
 * connection subject — only the latter names a grant. Returns that granting tuple's
 * `object` (the entity or node it targets), or `undefined` when the allow came via a role
 * (or, defensively, when no matching tuple is present).
 */
export declare function grantRefFromProof(permission: string, proof: readonly RelationTuple[]): string | undefined;
export declare const effectivePermissions: z.ZodObject<{
    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
    node: z.ZodObject<{
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    }, z.core.$strip>;
    permissions: z.ZodArray<z.ZodObject<{
        permission: z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">;
        proof: z.ZodArray<z.ZodObject<{
            subject: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
            relation: z.ZodString;
            object: z.core.$ZodBranded<z.ZodString, "ObjectRef", "out">;
        }, z.core.$strip>>;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type EffectivePermissions = z.infer<typeof effectivePermissions>;
//# sourceMappingURL=permission.d.ts.map