import type { IncomingHttpHeaders } from "node:http";
import type { WorkItem } from "../work-items/store.js";
export type ApprovalRootKind = "employee" | "virtual";
export interface RootApprovalTarget {
    name: string;
    department: string | null;
    kind: ApprovalRootKind;
}
export interface ApprovalRouteTarget {
    owner: string | null;
    target: string | null;
    root: string | null;
    rootKind: ApprovalRootKind | null;
    targetDepartment: string | null;
    targetIsVirtualRoot: boolean;
}
export interface ApprovalDecisionAuthority extends ApprovalRouteTarget {
    actor: string;
    kind: "employee" | "operator";
    employee?: string;
}
export type ApprovalAuthorityResult = {
    ok: true;
    authority: ApprovalDecisionAuthority;
} | {
    ok: false;
    status: 403;
    error: string;
};
export interface ApprovalDecisionAuthorityOptions {
    /** Browser/operator console acts as the root/COO only on the Todo approval surface. */
    operatorCanActOnRootTarget?: boolean;
    /** Set only after gateway bearer/cookie verification at the HTTP boundary. */
    operatorAuthenticated?: boolean;
    /** Gate reserved for the human operator: no employee may decide it, not even
     *  the COO, and not via escalation. Resolved by the caller from the workflow
     *  node that parked the gate. */
    operatorOnly?: boolean;
    /** Gate the workflow node handed to the COO's own lane: the portal session
     *  decides it, and every employee — including the employee-less child a
     *  session can spawn — still cannot. */
    cooDecidable?: boolean;
}
/** The session that produced this Todo, read off its provenance.
 *
 *  Exported because quick capture needs the SAME answer this file's authority
 *  walk uses: the Todo a Shaper may dispatch has to be the Todo its capture
 *  reports, and two definitions of "which session made this" would eventually
 *  disagree about exactly that. Note it is `sourceRef`, not `createdBy` —
 *  `createdBy` records the employee, so it cannot tell two captures apart. */
export declare function sourceSessionId(item: WorkItem): string | null;
export declare function resolveApprovalRouteTarget(item: WorkItem): ApprovalRouteTarget;
export declare function resolveRootApprovalTarget(): RootApprovalTarget | null;
export declare function resolveApprovalDecisionAuthority(headers: IncomingHttpHeaders, item: WorkItem, opts?: ApprovalDecisionAuthorityOptions): ApprovalAuthorityResult;
//# sourceMappingURL=approval-authority.d.ts.map