import { z } from 'zod';

declare const AccessKeyInputSchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
    systemPath: z.ZodString;
    action: z.ZodDefault<z.ZodEnum<{
        view: "view";
        manage: "manage";
    }>>;
}, z.core.$strict>]>;
type AccessKeyInput = z.input<typeof AccessKeyInputSchema>;
declare const AccessKeys: {
    readonly platformAdmin: {
        readonly systemPath: "platform.admin";
        readonly action: "view";
    };
    readonly organizationManage: {
        readonly systemPath: "permission.org";
        readonly action: "manage";
    };
    readonly membersManage: {
        readonly systemPath: "permission.members";
        readonly action: "manage";
    };
    readonly rolesManage: {
        readonly systemPath: "permission.roles";
        readonly action: "manage";
    };
    /** @reserved Reserved for first-class secret administration routes and command surfaces. */
    readonly secretsManage: {
        readonly systemPath: "permission.secrets";
        readonly action: "manage";
    };
    readonly operationsRead: {
        readonly systemPath: "permission.operations";
        readonly action: "view";
    };
    /** @reserved Reserved for write-level operations administration beyond read-only monitoring. */
    readonly operationsManage: {
        readonly systemPath: "permission.operations";
        readonly action: "manage";
    };
    readonly leadGenManage: {
        readonly systemPath: "sales.lead-gen";
        readonly action: "manage";
    };
    /** @reserved Reserved for acquisition administration once that permission namespace is wired. */
    readonly acquisitionManage: {
        readonly systemPath: "permission.acquisition";
        readonly action: "manage";
    };
    /** @reserved Reserved for project administration permission catalog compatibility. */
    readonly projectsManage: {
        readonly systemPath: "permission.projects";
        readonly action: "manage";
    };
    /** @reserved Reserved for client administration permission catalog compatibility. */
    readonly clientsManage: {
        readonly systemPath: "permission.clients";
        readonly action: "manage";
    };
    readonly operationsOverview: {
        readonly systemPath: "diagnostic.operations.overview";
        readonly action: "view";
    };
    /** @reserved Reserved for a diagnostics surface that lists recent operations executions. */
    readonly operationsRecentExecutions: {
        readonly systemPath: "diagnostic.operations.recent-executions";
        readonly action: "view";
    };
    readonly monitoringExecutionLogs: {
        readonly systemPath: "diagnostic.monitoring.execution-logs";
        readonly action: "view";
    };
    readonly monitoringNotifications: {
        readonly systemPath: "diagnostic.monitoring.notifications";
        readonly action: "view";
    };
};

type AccessRestrictedBy = 'catalog' | 'membership' | 'system-lifecycle' | 'role-permission' | 'diagnostic-allowlist' | null;
type AccessReason = 'allowed' | 'platform-admin-bypass' | 'invalid-access-key' | 'unknown-access-key' | 'organization-mismatch' | 'missing-membership' | 'system-not-active' | 'role-permission-denied' | 'diagnostic-key-not-allowed';
interface AccessAnswer {
    allowed: boolean;
    restrictedBy: AccessRestrictedBy;
    reason: AccessReason;
}

interface UseAccessResult extends AccessAnswer {
    isReady: boolean;
    isPlatformAdmin: boolean;
    permissions: readonly string[];
}
/**
 * Unified access hook for Organization Model system lifecycle, diagnostic keys,
 * role permissions, organization membership, and platform-admin bypass.
 */
declare function useAccess(key: AccessKeyInput): UseAccessResult;

export { AccessKeys, useAccess };
export type { AccessKeyInput, UseAccessResult };
