import { Context, Effect, Layer, Option, Schema } from "effect";
import type { AccessRequest } from "../tools/tool-authorization.js";
/** @experimental What a matched permission rule grants. */
export type Level = "allow" | "deny" | "ask";
/** @experimental One ordered permission rule. */
export interface Rule {
    readonly pattern: string;
    readonly level: Level;
    readonly reason?: string;
}
/** @experimental Ordered permission ruleset. */
export interface Ruleset {
    readonly rules: ReadonlyArray<Rule>;
    readonly fallback?: Level;
}
/** @experimental */
export interface Allow {
    readonly _tag: "Allow";
}
/** @experimental */
export interface Deny {
    readonly _tag: "Deny";
    readonly reason?: string;
}
/** @experimental */
export interface Ask {
    readonly _tag: "Ask";
    readonly token: string;
}
/** @experimental Resolved policy decision for one tool call. */
export type Decision = Allow | Deny | Ask;
declare const PermissionError_base: Schema.Class<PermissionError, Schema.TaggedStruct<"@batonfx/core/PermissionError", {
    readonly message: Schema.String;
}>, import("effect/Cause").YieldableError>;
/** @experimental Permission service failure. */
export declare class PermissionError extends PermissionError_base {
}
/** @experimental Permission policy service boundary. */
export interface Interface {
    readonly evaluate: (request: AccessRequest) => Effect.Effect<Decision, PermissionError>;
}
declare const Permissions_base: Context.ServiceClass<Permissions, "@batonfx/core/policy/permissions", Interface>;
/** @experimental */
export declare class Permissions extends Permissions_base {
}
/** @experimental Remembered-rule store. */
export interface RuleStoreInterface {
    readonly remember: (rule: Rule) => Effect.Effect<void, PermissionError>;
    readonly rules: Effect.Effect<ReadonlyArray<Rule>, PermissionError>;
}
declare const RuleStore_base: Context.ServiceClass<RuleStore, "@batonfx/core/policy/permissions/RuleStore", RuleStoreInterface>;
/** @experimental */
export declare class RuleStore extends RuleStore_base {
}
/** @experimental Match a permission pattern against a tool call. */
export declare const matches: {
    (tool: string, params: unknown): (pattern: string) => boolean;
    (pattern: string, tool: string, params: unknown): boolean;
};
/** @experimental Find the last matching rule without applying a fallback. */
export declare const matchRule: {
    (tool: string, params: unknown): (ruleset: Ruleset) => Option.Option<Rule>;
    (ruleset: Ruleset, tool: string, params: unknown): Option.Option<Rule>;
};
/** @experimental Evaluate a ruleset with last-match semantics. */
export declare const evaluate: {
    (tool: string, params: unknown): (ruleset: Ruleset) => Level;
    (ruleset: Ruleset, tool: string, params: unknown): Level;
};
/** @experimental Evaluate a base policy with remembered rules as a last-match overlay. */
export declare const evaluateWithRules: {
    (store: RuleStoreInterface, request: AccessRequest): (base: Interface) => Effect.Effect<Decision, PermissionError>;
    (base: Interface, store: RuleStoreInterface, request: AccessRequest): Effect.Effect<Decision, PermissionError>;
};
/** @experimental Policy from a static ruleset. */
export declare const layerRuleset: (ruleset: Ruleset) => Layer.Layer<Permissions>;
/** @experimental Permission policy that allows every call. */
export declare const layerAllowAll: Layer.Layer<Permissions>;
/** @experimental Non-durable in-memory remembered-rule store. */
export declare const layerRuleStoreMemory: (initialRules?: ReadonlyArray<Rule>) => Layer.Layer<RuleStore>;
/** @experimental */
export declare const layerRuleStoreTest: (implementation: RuleStoreInterface) => Layer.Layer<RuleStore>;
/** @experimental */
export declare const layerTest: (implementation: Interface) => Layer.Layer<Permissions>;
export {};