import { type ParticipantBindingEpoch } from "./canonical.ts";
export declare const BOSS_POLICY_SEMANTICS_VERSION: 1;
export declare const BOSS_POLICY_PRINCIPAL_VERSION: "boss.policy-principal.v1";
export declare const BOSS_POLICY_ACTIONS: readonly ["discover", "send", "ask", "reply", "control"];
export type BossPolicyAction = (typeof BOSS_POLICY_ACTIONS)[number];
export declare const BOSS_POLICY_ROLES: readonly ["boss", "manager", "adversary", "scout", "worker", "council", "controller"];
export type BossPolicyRole = (typeof BOSS_POLICY_ROLES)[number];
export declare const BOSS_CONTROL_KINDS: readonly ["assignment_request", "assignment_response", "health", "staffing", "review_request", "review_result", "proof", "lifecycle", "decision"];
export type BossControlKind = (typeof BOSS_CONTROL_KINDS)[number];
export type BossPolicyPrincipal = BossPrivatePrincipal | LegacyLocalPublicPrincipal;
export interface BossPrivatePrincipal {
    version: typeof BOSS_POLICY_PRINCIPAL_VERSION;
    principalId: string;
    principalClass: "boss-private";
    state: "active" | "revoked" | "replaced";
    bossRunId: string;
    participantId: string;
    role: BossPolicyRole;
    bindingEpoch: ParticipantBindingEpoch;
    assignedManagerParticipantId?: string;
    assignedParticipantIds?: string[];
    requestingPrincipalId?: string;
}
export interface LegacyLocalPublicPrincipal {
    version: typeof BOSS_POLICY_PRINCIPAL_VERSION;
    principalId: string;
    principalClass: "legacy-local-public";
    state: "active" | "revoked";
}
export interface BossPolicyState {
    principals: Record<string, BossPolicyPrincipal>;
}
export interface BossAuthorizationContext {
    actorBindingEpoch?: ParticipantBindingEpoch;
    targetBindingEpoch?: ParticipantBindingEpoch;
    controlKind?: BossControlKind;
    correlated?: boolean;
}
export type BossAuthorizationDenialCode = "UNKNOWN_PRINCIPAL" | "REVOKED_OR_REPLACED_PRINCIPAL" | "STALE_BINDING_EPOCH" | "CROSS_RUN_DENIED" | "BOSS_LEGACY_ISOLATION" | "CONTROL_REQUIRES_CORRELATION" | "CONTROL_KIND_DENIED" | "AMBIGUOUS_PARTICIPANT_IDENTITY" | "POLICY_DENIED";
export type BossAuthorizationDecision = {
    allowed: true;
    reason: "legacy-local-public" | "self" | "communication-profile" | "structured-control";
} | {
    allowed: false;
    code: BossAuthorizationDenialCode;
};
export declare function parseBossPolicyPrincipal(value: unknown): BossPolicyPrincipal;
/**
 * Role communication is deliberately broader than structured control. This
 * directional matrix is the complete role-level Boss v1 control allowlist;
 * omitted role pairs and omitted kinds fail closed. Assignment and requester
 * bindings are enforced separately below.
 */
export declare const BOSS_DIRECTIONAL_CONTROL_KIND_MATRIX: {
    readonly boss: {
        readonly manager: readonly ["lifecycle", "decision"];
        readonly adversary: readonly ["review_request"];
        readonly council: readonly ["review_request"];
        readonly controller: readonly ["lifecycle", "decision"];
    };
    readonly manager: {
        readonly boss: readonly ["health", "staffing", "proof", "lifecycle"];
        readonly adversary: readonly ["review_request"];
        readonly scout: readonly ["assignment_request", "lifecycle"];
        readonly worker: readonly ["assignment_request", "lifecycle"];
        readonly controller: readonly ["assignment_request", "health", "staffing", "review_request", "proof", "lifecycle"];
    };
    readonly adversary: {
        readonly boss: readonly ["health", "review_result", "proof"];
        readonly manager: readonly ["health", "review_result", "proof"];
        readonly controller: readonly ["health", "review_result", "proof"];
    };
    readonly scout: {
        readonly manager: readonly ["assignment_response", "health", "proof"];
        readonly controller: readonly ["assignment_response", "health"];
    };
    readonly worker: {
        readonly manager: readonly ["assignment_response", "health", "proof"];
        readonly controller: readonly ["assignment_response", "health"];
    };
    readonly council: {
        readonly boss: readonly ["health", "review_result"];
        readonly controller: readonly ["health", "review_result"];
    };
    readonly controller: {
        readonly boss: readonly ["health", "proof", "lifecycle", "decision"];
        readonly manager: readonly ["assignment_response", "health", "staffing", "review_result", "lifecycle", "decision"];
        readonly adversary: readonly ["review_request", "lifecycle"];
        readonly scout: readonly ["assignment_request", "lifecycle"];
        readonly worker: readonly ["assignment_request", "lifecycle"];
        readonly council: readonly ["review_request"];
    };
};
export declare function authorizeBossPolicy(state: BossPolicyState, actorId: string, action: BossPolicyAction, targetId: string, context?: BossAuthorizationContext): BossAuthorizationDecision;
//# sourceMappingURL=boss-policy.d.ts.map