import { type ApprovalRequestContract, type CapabilityDecision, type ExecutionGrant, type HarnessCapability, type ResourcePointer, type RiskBudget, type ToolCapabilityManifest, type WorkerRole } from "./contracts.ts";
export declare const DEFAULT_ROLE_CAPABILITY_CEILINGS: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;
export interface CompileExecutionGrantInput {
    objectiveId: string;
    taskId: string;
    attemptId: string;
    subjectId: string;
    role: WorkerRole;
    requiredCapabilities: readonly HarnessCapability[];
    requestedCapabilities?: readonly HarnessCapability[];
    authorityCapabilities: readonly HarnessCapability[];
    requestedTools: readonly string[];
    toolManifests: readonly ToolCapabilityManifest[];
    resources?: readonly ResourcePointer[];
    readPaths?: readonly string[];
    writePaths?: readonly string[];
    deniedPaths?: readonly string[];
    requestedBudget?: RiskBudget;
    authorityBudget?: RiskBudget;
    policyVersion: string;
    expiresAt?: string;
}
export type PolicyCompilationResult = {
    outcome: "allow";
    grant: ExecutionGrant;
    toolManifests: readonly ToolCapabilityManifest[];
} | {
    outcome: "approval-required";
    approval: ApprovalRequestContract;
    decisions: readonly CapabilityDecision[];
    reasonCodes: readonly string[];
} | {
    outcome: "deny";
    decisions: readonly CapabilityDecision[];
    reasonCodes: readonly string[];
};
export interface PolicyCompilerOptions {
    now?: () => string;
    createId?: () => string;
    roleCapabilityCeilings?: Readonly<Record<WorkerRole, readonly HarnessCapability[]>>;
}
export declare class ExecutionPolicyCompiler {
    private readonly now;
    private readonly createId;
    private readonly roleCapabilityCeilings;
    constructor(options?: PolicyCompilerOptions);
    compile(input: CompileExecutionGrantInput): PolicyCompilationResult;
}
//# sourceMappingURL=policy-compiler.d.ts.map