/**
 * Permission Definitions for Role-Based Access Control (RBAC)
 *
 * Defines a comprehensive permission system with:
 * - Resource-based permissions (resource:action format)
 * - Wildcard support for flexible permission patterns
 * - Permission categories for organization
 * - Permission validation and matching
 *
 * Permission format: `resource:action` or `resource:action:scope`
 * Examples:
 * - `intent:read` - Read any intent
 * - `intent:*` - All actions on intents
 * - `*` - All permissions (super admin)
 * - `tenant:user:create` - Create users within tenant scope
 *
 * @packageDocumentation
 */
import { z } from 'zod';
import type { ID } from '../../common/types.js';
/**
 * Permission actions that can be performed on resources
 */
export declare const PermissionActions: {
    readonly CREATE: "create";
    readonly READ: "read";
    readonly UPDATE: "update";
    readonly DELETE: "delete";
    readonly LIST: "list";
    readonly EXECUTE: "execute";
    readonly APPROVE: "approve";
    readonly REJECT: "reject";
    readonly ESCALATE: "escalate";
    readonly VERIFY: "verify";
    readonly EXPORT: "export";
    readonly IMPORT: "import";
    readonly ANALYZE: "analyze";
    readonly MANAGE: "manage";
    readonly CONFIGURE: "configure";
    readonly ALL: "*";
};
export type PermissionAction = (typeof PermissionActions)[keyof typeof PermissionActions];
/**
 * Resource types that can be protected
 */
export declare const ResourceTypes: {
    readonly TENANT: "tenant";
    readonly USER: "user";
    readonly AGENT: "agent";
    readonly SERVICE: "service";
    readonly INTENT: "intent";
    readonly POLICY: "policy";
    readonly CONSTRAINT: "constraint";
    readonly ESCALATION: "escalation";
    readonly PROOF: "proof";
    readonly AUDIT: "audit";
    readonly AUDIT_LOG: "audit_log";
    readonly CONFIG: "config";
    readonly ROLE: "role";
    readonly PERMISSION: "permission";
    readonly API_KEY: "api_key";
    readonly WEBHOOK: "webhook";
    readonly SESSION: "session";
    readonly TOKEN: "token";
    readonly CREDENTIAL: "credential";
    readonly SECRET: "secret";
    readonly KEY: "key";
    readonly DASHBOARD: "dashboard";
    readonly REPORT: "report";
    readonly MONITORING: "monitoring";
    readonly HEALTH: "health";
    readonly METRICS: "metrics";
    readonly PUBLIC: "public";
    readonly PROFILE: "profile";
    readonly TRUST_SCORE: "trust_score";
    readonly TRUST_SIGNAL: "trust_signal";
    readonly ALL: "*";
};
export type ResourceType = (typeof ResourceTypes)[keyof typeof ResourceTypes];
/**
 * Permission categories for organization
 */
export declare const PermissionCategories: {
    readonly ADMINISTRATION: "administration";
    readonly OPERATIONS: "operations";
    readonly SECURITY: "security";
    readonly AUDIT: "audit";
    readonly CONFIGURATION: "configuration";
    readonly MONITORING: "monitoring";
    readonly PUBLIC: "public";
};
export type PermissionCategory = (typeof PermissionCategories)[keyof typeof PermissionCategories];
/**
 * Permission definition
 */
export interface PermissionDefinition {
    /** Permission identifier (resource:action format) */
    id: string;
    /** Display name */
    name: string;
    /** Permission description */
    description: string;
    /** Resource type */
    resource: ResourceType | string;
    /** Action type */
    action: PermissionAction | string;
    /** Permission category */
    category: PermissionCategory;
    /** Whether this is sensitive (requires higher audit) */
    sensitive: boolean;
    /** Required for specific compliance (SOC2, GDPR, etc.) */
    compliance?: string[];
    /** Whether this is a system permission (cannot be modified) */
    isSystemPermission: boolean;
    /** Metadata */
    metadata?: Record<string, unknown>;
}
/**
 * Permission check request
 */
export interface PermissionCheckRequest {
    /** Subject requesting permission */
    subjectId: ID;
    /** Subject type */
    subjectType: 'user' | 'agent' | 'service';
    /** Required permission(s) */
    permissions: string[];
    /** Resource being accessed (for resource-specific checks) */
    resourceId?: ID;
    /** Resource type */
    resourceType?: string;
    /** Tenant context */
    tenantId?: ID;
    /** Additional context for evaluation */
    context?: Record<string, unknown>;
}
/**
 * Permission check result
 */
export interface PermissionCheckResult {
    /** Whether permission is granted */
    granted: boolean;
    /** Permissions that were granted */
    grantedPermissions: string[];
    /** Permissions that were denied */
    deniedPermissions: string[];
    /** Reason for denial (if denied) */
    reason?: string;
    /** How permission was granted (role, direct, inherited) */
    grantSource?: 'role' | 'direct' | 'inherited' | 'wildcard';
    /** Role that granted the permission */
    grantingRole?: string;
    /** Evaluation timestamp */
    evaluatedAt: string;
}
export declare const permissionDefinitionSchema: z.ZodObject<{
    id: z.ZodString;
    name: z.ZodString;
    description: z.ZodString;
    resource: z.ZodString;
    action: z.ZodString;
    category: z.ZodNativeEnum<{
        readonly ADMINISTRATION: "administration";
        readonly OPERATIONS: "operations";
        readonly SECURITY: "security";
        readonly AUDIT: "audit";
        readonly CONFIGURATION: "configuration";
        readonly MONITORING: "monitoring";
        readonly PUBLIC: "public";
    }>;
    sensitive: z.ZodBoolean;
    compliance: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    isSystemPermission: z.ZodBoolean;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    name?: string;
    action?: string;
    id?: string;
    description?: string;
    metadata?: Record<string, unknown>;
    resource?: string;
    compliance?: string[];
    category?: "audit" | "security" | "configuration" | "public" | "monitoring" | "administration" | "operations";
    sensitive?: boolean;
    isSystemPermission?: boolean;
}, {
    name?: string;
    action?: string;
    id?: string;
    description?: string;
    metadata?: Record<string, unknown>;
    resource?: string;
    compliance?: string[];
    category?: "audit" | "security" | "configuration" | "public" | "monitoring" | "administration" | "operations";
    sensitive?: boolean;
    isSystemPermission?: boolean;
}>;
export declare const permissionCheckRequestSchema: z.ZodObject<{
    subjectId: z.ZodString;
    subjectType: z.ZodEnum<["user", "agent", "service"]>;
    permissions: z.ZodArray<z.ZodString, "many">;
    resourceId: z.ZodOptional<z.ZodString>;
    resourceType: z.ZodOptional<z.ZodString>;
    tenantId: z.ZodOptional<z.ZodString>;
    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    tenantId?: string;
    permissions?: string[];
    context?: Record<string, unknown>;
    resourceType?: string;
    resourceId?: string;
    subjectId?: string;
    subjectType?: "agent" | "user" | "service";
}, {
    tenantId?: string;
    permissions?: string[];
    context?: Record<string, unknown>;
    resourceType?: string;
    resourceId?: string;
    subjectId?: string;
    subjectType?: "agent" | "user" | "service";
}>;
export declare const permissionCheckResultSchema: z.ZodObject<{
    granted: z.ZodBoolean;
    grantedPermissions: z.ZodArray<z.ZodString, "many">;
    deniedPermissions: z.ZodArray<z.ZodString, "many">;
    reason: z.ZodOptional<z.ZodString>;
    grantSource: z.ZodOptional<z.ZodEnum<["role", "direct", "inherited", "wildcard"]>>;
    grantingRole: z.ZodOptional<z.ZodString>;
    evaluatedAt: z.ZodString;
}, "strip", z.ZodTypeAny, {
    evaluatedAt?: string;
    reason?: string;
    granted?: boolean;
    grantedPermissions?: string[];
    deniedPermissions?: string[];
    grantSource?: "role" | "direct" | "inherited" | "wildcard";
    grantingRole?: string;
}, {
    evaluatedAt?: string;
    reason?: string;
    granted?: boolean;
    grantedPermissions?: string[];
    deniedPermissions?: string[];
    grantSource?: "role" | "direct" | "inherited" | "wildcard";
    grantingRole?: string;
}>;
/**
 * Get all built-in system permissions
 */
export declare function getBuiltinPermissions(): PermissionDefinition[];
/**
 * Parse a permission string into resource and action
 */
export declare function parsePermission(permission: string): {
    resource: string;
    action: string;
    scope?: string;
};
/**
 * Build a permission string from components
 */
export declare function buildPermission(resource: string, action: string, scope?: string): string;
/**
 * Check if a permission string matches a required permission
 * Supports wildcard matching
 */
export declare function permissionMatches(granted: string, required: string): boolean;
/**
 * Check if any granted permission matches the required permission
 */
export declare function hasPermission(grantedPermissions: Set<string> | string[], requiredPermission: string): boolean;
/**
 * Check if all required permissions are granted
 */
export declare function hasAllPermissions(grantedPermissions: Set<string> | string[], requiredPermissions: string[]): boolean;
/**
 * Check if any of the required permissions are granted
 */
export declare function hasAnyPermission(grantedPermissions: Set<string> | string[], requiredPermissions: string[]): boolean;
/**
 * Get all permissions that match a pattern
 */
export declare function filterMatchingPermissions(allPermissions: string[], pattern: string): string[];
/**
 * Validate a permission string format
 */
export declare function isValidPermissionFormat(permission: string): boolean;
/**
 * Get permissions grouped by category
 */
export declare function getPermissionsByCategory(): Record<PermissionCategory, PermissionDefinition[]>;
/**
 * Get sensitive permissions
 */
export declare function getSensitivePermissions(): PermissionDefinition[];
/**
 * Get permissions required for compliance
 */
export declare function getCompliancePermissions(compliance: string): PermissionDefinition[];
/**
 * Create a custom permission definition
 */
export declare function createPermissionDefinition(partial: Omit<PermissionDefinition, 'isSystemPermission'> & Partial<Pick<PermissionDefinition, 'isSystemPermission'>>): PermissionDefinition;
//# sourceMappingURL=permissions.d.ts.map