//#region src/auth/authz/config.d.ts
/**
 * Check if a SpiceDB endpoint is localhost (used for TLS auto-detection).
 */
declare function isLocalhostEndpoint(endpoint: string): boolean;
/**
 * Get SpiceDB connection configuration from environment variables.
 * TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
 */
declare function getSpiceDbConfig(): {
  endpoint: string;
  token: string;
  tlsEnabled: boolean;
};
/**
 * Branded SpiceDB object ID types.
 *
 * SpiceDB object IDs are global — `credential_reference:cred_foo` refers to one
 * object regardless of who wrote the tuple. To prevent cross-tenant collisions we
 * namespace composite-PK resources under their scope (`{tenantId}/{projectId}/...`).
 *
 * The brand is enforcement, not decoration: downstream helpers accept only the
 * branded type, so a raw DB ID can never be passed to a SpiceDB call without
 * going through the appropriate `toSpiceDb*Id` constructor. This catches at
 * compile time the "forgot to tenant-prefix" bug class.
 */
type SpiceDbProjectId = string & {
  readonly __brand: 'SpiceDbProjectId';
};
type SpiceDbCredentialReferenceId = string & {
  readonly __brand: 'SpiceDbCredentialReferenceId';
};
/**
 * Compose a tenant-scoped SpiceDB project object ID.
 *
 * Format: `{tenantId}/{projectId}` — projects' backing-store PK is
 * `(tenantId, projectId)`, so this mirrors that composite key verbatim.
 */
declare function toSpiceDbProjectId(tenantId: string, projectId: string): SpiceDbProjectId;
/**
 * Parse a tenant-scoped SpiceDB project object ID back into its parts.
 *
 * @returns `{ tenantId, projectId }` extracted from the composite ID.
 * @throws if the ID does not contain the separator.
 */
declare function fromSpiceDbProjectId(spiceDbProjectId: SpiceDbProjectId | string): {
  tenantId: string;
  projectId: string;
};
/**
 * Compose a tenant+project-scoped SpiceDB credential_reference object ID.
 *
 * Format: `{tenantId}/{projectId}/{credentialReferenceId}` — credentials' backing-store
 * PK is `(tenantId, projectId, id)`, so this mirrors that composite key verbatim.
 * Without this scoping, two tenants that each define a credential with the same
 * slug (e.g. `cred_helpscout`) would share the same SpiceDB object and any grant
 * on one would appear to grant the other.
 */
declare function toSpiceDbCredentialReferenceId(tenantId: string, projectId: string, credentialReferenceId: string): SpiceDbCredentialReferenceId;
//#endregion
export { SpiceDbCredentialReferenceId, SpiceDbProjectId, fromSpiceDbProjectId, getSpiceDbConfig, isLocalhostEndpoint, toSpiceDbCredentialReferenceId, toSpiceDbProjectId };