/**
 * WPC v2 Policy Evaluator — IAM-style policy engine.
 *
 * Evaluation rules (matching AWS IAM semantics):
 * 1. Default deny: if no statement explicitly allows, the action is denied.
 * 2. Explicit Deny always wins over Allow.
 * 3. Strict Intersection: when `inherits` is set, parent AND child must both allow.
 *
 * Pure TypeScript, zero external dependencies, deterministic, offline.
 * Designed to run in Cloudflare Workers (<5ms for 20 statements).
 */
/** WPC v1 schema (for backward compatibility). */
export interface WPCv1 {
    policy_version: '1';
    policy_id: string;
    issuer_did: string;
    allowed_providers?: string[];
    allowed_models?: string[];
    minimum_model_identity_tier?: string;
    egress_allowlist?: string[];
    redaction_rules?: unknown[];
    receipt_privacy_mode?: string;
    required_audit_packs?: string[];
    metadata?: Record<string, unknown>;
}
/** Condition operator map: context-key -> expected value. */
export type ConditionMap = Record<string, string>;
/** Condition operators supported by the evaluator. */
export interface PolicyConditions {
    StringEquals?: ConditionMap;
    StringNotEquals?: ConditionMap;
    StringLike?: ConditionMap;
    StringNotLike?: ConditionMap;
    NumericEquals?: ConditionMap;
    NumericLessThan?: ConditionMap;
    NumericGreaterThan?: ConditionMap;
    Bool?: ConditionMap;
    IpAddress?: ConditionMap;
}
/** A single IAM-style policy statement. */
export interface PolicyStatement {
    sid: string;
    effect: 'Allow' | 'Deny';
    actions: string[];
    resources: string[];
    conditions?: PolicyConditions;
}
/** WPC v2 schema. */
export interface WPCv2 {
    policy_version: '2';
    policy_id: string;
    issuer_did: string;
    inherits?: string;
    statements: PolicyStatement[];
    metadata?: Record<string, unknown>;
}
/** Union type for any WPC version. */
export type WPC = WPCv1 | WPCv2;
/** Context keys available during policy evaluation. */
export interface PolicyContext {
    /** Agent's DID (Agent:DID) */
    'Agent:DID'?: string;
    /** Model provider (Model:Provider) */
    'Model:Provider'?: string;
    /** Model name (Model:Name) */
    'Model:Name'?: string;
    /** Proof tier from receipt (Receipt:ProofTier) */
    'Receipt:ProofTier'?: string;
    /** Whether human approval was obtained (Request:HasHumanApproval) */
    'Request:HasHumanApproval'?: string;
    /** Target domain for network egress (SideEffect:TargetDomain) */
    'SideEffect:TargetDomain'?: string;
    /** Tool name being invoked (Tool:Name) */
    'Tool:Name'?: string;
    /** Hour of day 0-23 (Context:Hour) */
    'Context:Hour'?: string;
    /** Allow additional context keys. */
    [key: string]: string | undefined;
}
export type PolicyDecisionEffect = 'ALLOW' | 'DENY';
/** Result of evaluating a policy against an action + context. */
export interface PolicyDecision {
    effect: PolicyDecisionEffect;
    /** Human-readable reason for the decision. */
    reason: string;
    /** Statement IDs that contributed to the decision. */
    matched_statements: string[];
}
/** Resolver for parent policies (used in Strict Intersection). */
export type PolicyResolver = (policyId: string) => WPCv2 | WPC | null;
/**
 * Convert a WPC v1 to v2 statements for evaluation.
 * This mirrors the logic in the migration helper but is kept inline
 * to avoid circular deps.
 */
export declare function convertV1toV2(v1: WPCv1): WPCv2;
/**
 * Evaluate a WPC policy against an action, resource, and context.
 *
 * Supports both WPC v1 (auto-converted) and v2 policies.
 * When `inherits` is set and a `resolver` is provided, performs
 * Strict Intersection (parent AND child must both allow).
 *
 * @param policy - The WPC policy (v1 or v2)
 * @param action - The action being requested (e.g., "model:invoke")
 * @param resource - The resource being acted upon (e.g., "src/index.ts")
 * @param context - Context keys from the proof bundle / runtime
 * @param resolver - Optional resolver for parent policies (Strict Intersection)
 */
export declare function evaluatePolicy(policy: WPC, action: string, resource: string, context: PolicyContext, resolver?: PolicyResolver): PolicyDecision;
/**
 * Convenience: evaluate multiple actions against a policy.
 * Returns a map of action -> PolicyDecision.
 */
export declare function evaluatePolicyBatch(policy: WPC, requests: Array<{
    action: string;
    resource: string;
}>, context: PolicyContext, resolver?: PolicyResolver): Map<string, PolicyDecision>;
//# sourceMappingURL=policy-evaluator.d.ts.map