/**
 * describePolicyBundle — JSON-serialisable introspection of a PolicyBundle.
 *
 * Pure read-only walk over the guard arrays. Reads `GuardMetadata` attached
 * via `withMetadata`; emits `{ kind: "anonymous" }` for guards without it.
 * The taint phase is rendered as a single virtual descriptor so consumers
 * can render all four phases uniformly — the taint object is a
 * `TaintPolicy` (kind→Taint lookup), not a guard array, so its descriptor
 * carries no name/author/since.
 *
 * Used by:
 *   - `apps/console` governance visualiser (shows the policy structure)
 *   - `apps/web` GuardMetadata force-graph
 *   - analyzer tooling that wants to traverse policy without invoking guards
 *
 * Per ADR-105: metadata is permanently optional. Consumers MUST handle
 * `{ kind: "anonymous" }` and `{ kind: "named" }` without metadata.description.
 */
import { type GuardMetadata, type PolicyBundle } from "./policy.js";
export type PolicyPhase = "state" | "taint" | "auth" | "business";
/**
 * Optional per-guard code-artifact digest (081). When a guard exposed a
 * `GuardCodeArtifact` (closure-captured caps + predicate source) via
 * `attachGuardCodeArtifact`, this is `sha256Canonical(codeArtifact)` so the
 * ConfigSeal binds the *executable* surface, not just the declared metadata.
 * Absent for guards with no artifact to pin (back-compatible: the descriptor
 * shape for metadata-only guards is otherwise unchanged).
 *
 * Pure: sha256-over-canonical-JSON via `@adjudicate/canonical` (the single
 * invariant-#4-compatible encoder), no clock / RNG / IO. Deterministic — the
 * same artifact always yields the same digest, so re-extraction is
 * byte-identical (§D-inv-5).
 */
export type GuardDescriptor = {
    readonly kind: "named";
    readonly metadata: GuardMetadata;
    readonly codeDigest?: string;
} | {
    readonly kind: "anonymous";
    readonly codeDigest?: string;
};
export interface PolicyPhaseDescriptor {
    readonly phase: PolicyPhase;
    readonly guards: ReadonlyArray<GuardDescriptor>;
}
export interface PolicyBundleDescriptor {
    readonly default: "REFUSE" | "EXECUTE";
    readonly phases: ReadonlyArray<PolicyPhaseDescriptor>;
}
export declare function describePolicyBundle<K extends string, P, S>(bundle: PolicyBundle<K, P, S>): PolicyBundleDescriptor;
//# sourceMappingURL=describe.d.ts.map