//#region src/auth/authz/types.d.ts
/**
 * Client-safe authz types and constants.
 * These can be safely imported in client-side code without any Node.js dependencies.
 */
/**
 * SpiceDB resource types used in the schema
 */
declare const SpiceDbResourceTypes: {
  readonly USER: "user";
  readonly ORGANIZATION: "organization";
  readonly PROJECT: "project";
  readonly APP: "app";
  readonly CREDENTIAL_REFERENCE: "credential_reference";
};
/**
 * SpiceDB relations used in the schema
 *
 * Relations are named as nouns (roles) per SpiceDB best practices.
 * Project roles are prefixed for clarity when debugging/grepping.
 */
declare const SpiceDbRelations: {
  readonly OWNER: "owner";
  readonly ADMIN: "admin";
  readonly MEMBER: "member";
  readonly ORGANIZATION: "organization";
  readonly PROJECT_ADMIN: "project_admin";
  readonly PROJECT_MEMBER: "project_member";
  readonly PROJECT_VIEWER: "project_viewer";
  readonly APP_READER: "app_reader";
};
/**
 * SpiceDB permissions for organization resources.
 *
 * From schema.zed definition organization:
 * - view: owner + admin + member
 * - manage: owner + admin (includes managing org settings and all projects)
 */
declare const SpiceDbOrgPermissions: {
  readonly VIEW: "view";
  readonly MANAGE: "manage";
};
type SpiceDbOrgPermission = (typeof SpiceDbOrgPermissions)[keyof typeof SpiceDbOrgPermissions];
/**
 * SpiceDB permissions for project resources.
 *
 * From schema.zed definition project:
 * - view: read-only access to project and its resources
 * - use: invoke agents, create API keys, view traces
 * - edit: modify configurations, manage members
 */
declare const SpiceDbProjectPermissions: {
  readonly VIEW: "view";
  readonly USE: "use";
  readonly EDIT: "edit";
};
type SpiceDbProjectPermission = (typeof SpiceDbProjectPermissions)[keyof typeof SpiceDbProjectPermissions];
declare const SpiceDbCredentialReferencePermissions: {
  readonly READ: "read";
};
type SpiceDbCredentialReferencePermission = (typeof SpiceDbCredentialReferencePermissions)[keyof typeof SpiceDbCredentialReferencePermissions];
/**
 * Permission levels for project access checks.
 */
type ProjectPermissionLevel = SpiceDbProjectPermission;
/**
 * Organization roles from SpiceDB schema.
 */
declare const OrgRoles: {
  readonly OWNER: "owner";
  readonly ADMIN: "admin";
  readonly MEMBER: "member";
};
type OrgRole = (typeof OrgRoles)[keyof typeof OrgRoles];
/**
 * Project roles from SpiceDB schema.
 *
 * Hierarchy:
 * - project_admin: Full access (view + use + edit + manage members)
 * - project_member: Operator access (view + use: invoke agents, create API keys)
 * - project_viewer: Read-only access (view only)
 */
declare const ProjectRoles: {
  readonly ADMIN: "project_admin";
  readonly MEMBER: "project_member";
  readonly VIEWER: "project_viewer";
};
type ProjectRole = (typeof ProjectRoles)[keyof typeof ProjectRoles];
/**
 * Project permission capabilities.
 * Maps to the SpiceDB permission checks (view, use, edit).
 */
interface ProjectPermissions {
  canView: boolean;
  canUse: boolean;
  canEdit: boolean;
}
//#endregion
export { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbCredentialReferencePermission, SpiceDbCredentialReferencePermissions, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes };