/**
 * Policy bridge — enforces authorization across service boundaries.
 *
 * The policy bridge solves a critical federation problem: when Service A
 * invokes a command on Service B, Service B must still enforce its own
 * authorization policies. The bridge:
 *
 * 1. Extracts the caller's identity from the local RuntimeContext
 * 2. Propagates it across the network as policy bridge headers
 * 3. On the receiving side, reconstructs a RuntimeContext from those headers
 * 4. The receiving service's policy engine evaluates against the reconstructed context
 *
 * The bridge NEVER trusts the caller to enforce its own policies — every
 * service is responsible for evaluating its own authorization rules using
 * the forwarded identity.
 *
 * @module federation/policy-bridge
 */
import type { PolicyBridgeHeaders } from './types';
import type { RuntimeContext } from '../runtime-engine';
/**
 * Build policy bridge headers from a local RuntimeContext.
 * Extracts actor identity, tenant, org, and roles for cross-service propagation.
 */
export declare function buildBridgeFromContext(context: RuntimeContext): PolicyBridgeHeaders;
/**
 * Reconstruct a RuntimeContext from incoming policy bridge headers.
 * The receiving service uses this to evaluate its own policies against
 * the caller's identity.
 *
 * Strict by default: missing actor identity is preserved as undefined
 * (policies that require actor checks will fail closed).
 */
export declare function contextFromBridgeHeaders(headers: PolicyBridgeHeaders): RuntimeContext;
/**
 * Extract policy bridge headers from a standard Headers object or plain object.
 * Handles both case-insensitive HTTP headers and the canonical camelCase form.
 */
export declare function parseBridgeHeaders(source: Headers | Record<string, string>): PolicyBridgeHeaders;
/**
 * Validate that a set of bridge headers carries the minimum required
 * identity information for cross-service policy enforcement.
 * Returns null if valid, or a string explaining the validation failure.
 */
export declare function validateBridgeHeaders(headers: PolicyBridgeHeaders): string | null;
/**
 * Compute a correlation ID for a cross-service workflow if one isn't provided.
 * Uses a deterministic prefix + timestamp + counter for tracing.
 */
export declare function ensureCorrelationId(existing?: string): string;
//# sourceMappingURL=policy-bridge.d.ts.map