import type { Db } from "@paperclipai/db";
import type { PermissionKey, PrincipalType } from "@paperclipai/shared";
export type AuthorizationActor = {
    type: "board" | "agent" | "none";
    userId?: string | null;
    companyIds?: string[];
    memberships?: Array<{
        companyId: string;
        membershipRole?: string | null;
        status?: string;
    }>;
    isInstanceAdmin?: boolean;
    agentId?: string | null;
    companyId?: string | null;
    runId?: string | null;
    source?: "local_implicit" | "session" | "board_key" | "agent_key" | "agent_jwt" | "cloud_tenant" | "none";
};
export type AuthorizationAction = PermissionKey | "agent_config:read" | "agent_config:update" | "agent:read" | "agent:wake" | "company_scope:read" | "issue:mutate" | "issue:read" | "project:read" | "runtime:manage" | "secrets:read";
export type AuthorizationResource = {
    type: "company";
    companyId: string;
} | {
    type: "agent";
    companyId: string;
    agentId?: string | null;
} | {
    type: "project";
    companyId: string;
    projectId?: string | null;
} | {
    type: "issue";
    companyId: string;
    issueId?: string | null;
    projectId?: string | null;
    parentIssueId?: string | null;
    assigneeAgentId?: string | null;
    assigneeUserId?: string | null;
    status?: string | null;
};
export type AuthorizationDecision = {
    allowed: boolean;
    action: AuthorizationAction;
    explanation: string;
    reason: "allow_low_trust_boundary" | "allow_local_board" | "allow_instance_admin" | "allow_explicit_grant" | "allow_legacy_agent_creator" | "allow_self" | "allow_company_agent" | "allow_simple_company_member" | "allow_manager_chain" | "deny_unauthenticated" | "deny_company_boundary" | "deny_missing_membership" | "deny_missing_grant" | "deny_policy_restricted" | "deny_low_trust_boundary" | "deny_scope" | "deny_unsupported_action";
    grant?: {
        principalType: PrincipalType;
        principalId: string;
        permissionKey: PermissionKey;
        scope: Record<string, unknown> | null;
    };
};
type PrincipalGrantDecision = AuthorizationDecision & {
    grant?: NonNullable<AuthorizationDecision["grant"]>;
};
export declare function authorizationService(db: Db): {
    decide: (input: {
        actor: AuthorizationActor;
        action: AuthorizationAction;
        resource: AuthorizationResource;
        scope?: Record<string, unknown> | null;
    }) => Promise<AuthorizationDecision>;
    decidePrincipalGrant: (input: {
        companyId: string;
        principalType: PrincipalType;
        principalId: string;
        action: AuthorizationAction;
        permissionKey: PermissionKey;
        scope?: Record<string, unknown> | null;
    }) => Promise<PrincipalGrantDecision>;
};
export {};
//# sourceMappingURL=authorization.d.ts.map