/** Role grant, version and audit response schemas. */
import { z } from 'zod';
/** A role's per-tag ACCESS LEVEL: `none` (no access), `read`, or `write`. */
export declare const grantLevel: z.ZodEnum<{
    none: "none";
    read: "read";
    write: "write";
}>;
export type GrantLevel = z.infer<typeof grantLevel>;
/** A role's editable grant map: feature-group TAG name → the role's access level. */
export declare const roleGrants: z.ZodRecord<z.ZodString, z.ZodEnum<{
    none: "none";
    read: "read";
    write: "write";
}>>;
export type RoleGrants = z.infer<typeof roleGrants>;
export declare const roleList: z.ZodArray<z.ZodObject<{
    allow_all: z.ZodDefault<z.ZodBoolean>;
    base_tier: z.ZodDefault<z.ZodUnion<readonly [z.ZodString, z.ZodNull]>>;
    condition: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
        content: z.ZodOptional<z.ZodString>;
        id: z.ZodOptional<z.ZodString>;
        kwargs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, z.core.$strict>, z.ZodNull]>>;
    description: z.ZodString;
    grants: z.ZodRecord<z.ZodString, z.ZodEnum<{
        none: "none";
        read: "read";
        write: "write";
    }>>;
    name: z.ZodString;
    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
}, z.core.$strip>>;
/** `DELETE /api/auth/roles/{name}` — the deleted role's name. */
export declare const roleDeleted: z.ZodObject<{
    name: z.ZodString;
    deleted: z.ZodBoolean;
}, z.core.$strip>;
/**
 * One immutable role-version row (`GET /api/auth/roles/{name}/versions` →
 * `versions`). `body` is the role body at that version; `is_current` flags the
 * active pointer. Mirrors the generic versioned-store row shape.
 */
export declare const roleVersion: z.ZodObject<{
    version: z.ZodNumber;
    body: z.ZodObject<{
        allow_all: z.ZodDefault<z.ZodBoolean>;
        base_tier: z.ZodDefault<z.ZodUnion<readonly [z.ZodString, z.ZodNull]>>;
        condition: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
            content: z.ZodOptional<z.ZodString>;
            id: z.ZodOptional<z.ZodString>;
            kwargs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
        }, z.core.$strict>, z.ZodNull]>>;
        description: z.ZodString;
        grants: z.ZodRecord<z.ZodString, z.ZodEnum<{
            none: "none";
            read: "read";
            write: "write";
        }>>;
        name: z.ZodString;
        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
    }, z.core.$strip>;
    tags: z.ZodArray<z.ZodString>;
    created_at: z.ZodString;
    is_current: z.ZodBoolean;
}, z.core.$strip>;
export type RoleVersion = z.infer<typeof roleVersion>;
/**
 * One who/action/before→after audit row (`GET /api/auth/roles/{name}/versions` →
 * `audit`). Its `body` carries the mutation kind, the actor, and the before/after
 * role bodies (both `null` for a create's `before` / a delete's `after`).
 */
export declare const roleAuditEvent: z.ZodObject<{
    version: z.ZodNumber;
    body: z.ZodObject<{
        action: z.ZodString;
        actor: z.ZodNullable<z.ZodString>;
        before: z.ZodNullable<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
        after: z.ZodNullable<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    }, z.core.$strip>;
    tags: z.ZodArray<z.ZodString>;
    created_at: z.ZodString;
    is_current: z.ZodBoolean;
}, z.core.$strip>;
export type RoleAuditEvent = z.infer<typeof roleAuditEvent>;
/** `GET /api/auth/roles/{name}/versions` — the append-only history + audit trail. */
export declare const roleVersions: z.ZodObject<{
    versions: z.ZodArray<z.ZodObject<{
        version: z.ZodNumber;
        body: z.ZodObject<{
            allow_all: z.ZodDefault<z.ZodBoolean>;
            base_tier: z.ZodDefault<z.ZodUnion<readonly [z.ZodString, z.ZodNull]>>;
            condition: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
                content: z.ZodOptional<z.ZodString>;
                id: z.ZodOptional<z.ZodString>;
                kwargs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
            }, z.core.$strict>, z.ZodNull]>>;
            description: z.ZodString;
            grants: z.ZodRecord<z.ZodString, z.ZodEnum<{
                none: "none";
                read: "read";
                write: "write";
            }>>;
            name: z.ZodString;
            scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
        }, z.core.$strip>;
        tags: z.ZodArray<z.ZodString>;
        created_at: z.ZodString;
        is_current: z.ZodBoolean;
    }, z.core.$strip>>;
    audit: z.ZodArray<z.ZodObject<{
        version: z.ZodNumber;
        body: z.ZodObject<{
            action: z.ZodString;
            actor: z.ZodNullable<z.ZodString>;
            before: z.ZodNullable<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
            after: z.ZodNullable<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
        }, z.core.$strip>;
        tags: z.ZodArray<z.ZodString>;
        created_at: z.ZodString;
        is_current: z.ZodBoolean;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type RoleVersions = z.infer<typeof roleVersions>;
//# sourceMappingURL=roles.d.ts.map