import { z } from "zod";
/**
 * Audiences a grant can represent. Mirrors the `Actor`/`Visibility` unions in
 * `@voyant-travel/core` / `@voyant-travel/catalog-contracts`, duplicated here so
 * the low-level `types` package stays dependency-free. Carried on the key grant
 * and resolved into the catalog `ResolverScope` at request time (never inferred
 * from the scope set).
 */
export declare const API_KEY_AUDIENCES: readonly ["staff", "customer", "partner", "supplier"];
export type ApiKeyAudience = (typeof API_KEY_AUDIENCES)[number];
export type ApiKeyPermissions = Record<string, string[]>;
export type ApiKeyPermissionString = "*" | "*:*" | `${string}:*` | `*:${string}` | `${string}:${string}`;
export interface ApiKeyPermissionDescriptor {
    resource: string;
    action: string;
    label: string;
    description: string;
    sensitive?: boolean;
}
export interface ApiKeyPermissionGroup {
    resource: string;
    label: string;
    description: string;
    permissions: ApiKeyPermissionDescriptor[];
}
export interface AccessCatalogAction {
    action: string;
    label: string;
    description: string;
    sensitive?: boolean;
    remoteSafe?: boolean;
    wildcard?: "allow" | "explicit";
}
export interface AccessCatalogResource {
    id: string;
    unitId: string;
    resource: string;
    label: string;
    description: string;
    wildcard: "allow" | "explicit-resource";
    remoteSafe?: boolean;
    actions: readonly AccessCatalogAction[];
    legacyActions?: readonly string[];
}
export interface AccessCatalogPreset {
    id: string;
    kind: "api-token" | "api-token-grant" | "staff";
    label: string;
    description: string;
    grants: readonly string[];
    audience?: ApiKeyAudience;
}
export interface AccessCatalog {
    resources: readonly AccessCatalogResource[];
    presets: readonly AccessCatalogPreset[];
}
/** Resource and action descriptors are supplied by the selected deployment graph. */
export declare function accessCatalogPermissionGroups(catalog: AccessCatalog): ApiKeyPermissionGroup[];
/** Thrown by `assertKnownPermissions` when a permission names an unknown resource or action. */
export declare class UnknownApiKeyPermissionError extends Error {
    readonly resource?: string | undefined;
    readonly action?: string | undefined;
    constructor(message: string, resource?: string | undefined, action?: string | undefined);
}
/**
 * Validate that every permission names a known resource + action (or a `*`
 * wildcard). Used at key-mint time so a typo'd scope is rejected instead of
 * silently accepted (and then never matching anything). Throws
 * `UnknownApiKeyPermissionError` on the first unknown token.
 */
export declare function assertKnownPermissions(permissions: string | ApiKeyPermissions | null | undefined, catalog: AccessCatalog): void;
/** Non-throwing variant of {@link assertKnownPermissions}. */
export declare function areKnownPermissions(permissions: string | ApiKeyPermissions | null | undefined, catalog: AccessCatalog): boolean;
export declare const apiKeyPermissionStringSchema: z.ZodString & z.ZodType<ApiKeyPermissionString, string, z.core.$ZodTypeInternals<ApiKeyPermissionString, string>>;
export declare const apiKeyPermissionsSchema: z.ZodPipe<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>, z.ZodTransform<ApiKeyPermissions, Record<string, string[]>>>;
export declare function normalizeApiKeyPermissions(permissions: string | ApiKeyPermissions | null | undefined): ApiKeyPermissions;
export declare function permissionStringsToPermissions(permissions: readonly string[]): ApiKeyPermissions;
export declare function permissionsToStrings(permissions: string | ApiKeyPermissions | null | undefined): ApiKeyPermissionString[];
export declare function hasApiKeyPermission(permissions: string | ApiKeyPermissions | null | undefined, resource: string, action: string, catalog?: AccessCatalog): boolean;
export declare function hasApiKeyPermissions(permissions: string | ApiKeyPermissions | null | undefined, required: ApiKeyPermissions, catalog?: AccessCatalog): boolean;
export declare function describePermissions(permissions: string | ApiKeyPermissions | null | undefined): string;
/**
 * Format a permission scope as host-owned consent copy. Callers should retain
 * the raw scope as secondary technical detail; publishers must never supply the
 * primary label shown to a customer approving access.
 */
export declare function formatApiKeyPermissionLabel(scope: string): string;
export declare const EXPIRATION_PRESETS: {
    readonly never: {
        readonly label: "Never";
        readonly days: null;
    };
    readonly "7days": {
        readonly label: "7 days";
        readonly days: 7;
    };
    readonly "30days": {
        readonly label: "30 days";
        readonly days: 30;
    };
    readonly "90days": {
        readonly label: "90 days";
        readonly days: 90;
    };
    readonly "180days": {
        readonly label: "6 months";
        readonly days: 180;
    };
    readonly "365days": {
        readonly label: "1 year";
        readonly days: 365;
    };
    readonly custom: {
        readonly label: "Custom date";
        readonly days: null;
    };
};
export type ExpirationPresetKey = keyof typeof EXPIRATION_PRESETS;
export declare function calculateExpirationDate(preset: ExpirationPresetKey, customDate?: Date): Date | null;