/**
 * Outbound grant expression building.
 *
 * Builds a composed grant expression for kernel calls:
 *   grant = union(credential(delegationJWT), self)
 *
 * The kernel resolves this by verifying the delegation JWT (kernel-signed)
 * to get the caller's scoped identity, and resolving self to the function's
 * identity. Union means either identity's permissions work.
 */
import type { Delegation } from '@astrale-os/kernel-core';
/**
 * The composed identity expression: union of the caller's delegated access
 * (a kernel-signed credential leaf) and the function's own identity (self).
 *
 * Used both as the grant on outbound kernel calls AND as the delegation
 * expression when minting a NEXT-HOP credential — the next worker receives
 * principal = this function, authority = union(caller's delegated, own).
 */
export declare function buildComposedExpr(delegation: Delegation): import("@astrale-os/kernel-core").UnresolvedIdentityExpr;
/**
 * Build the grant expression that unions the caller's delegated access
 * with the function's own identity.
 *
 * @param delegation - Delegation extracted from the inbound credential
 * @returns The unresolved grant object with version and expression
 */
export declare function buildComposedGrant(delegation: Delegation): {
    grant: import("@astrale-os/kernel-core").UnresolvedGrant;
};
/**
 * The SELF-ONLY expression: the function's own identity, nothing delegated.
 * Used by `ctx.fn.kernel()` sessions (public/webhook handlers acting on their own
 * authority) — both as the credential grant and as the next-hop delegation.
 */
export declare function buildSelfExpr(): import("@astrale-os/kernel-core").UnresolvedIdentityExpr;
/** Self-only grant for function-owned credentials. */
export declare function buildSelfGrant(): {
    grant: import("@astrale-os/kernel-core").UnresolvedGrant;
};
//# sourceMappingURL=compose.d.ts.map