import { type ParticipantBindingEpoch } from "./canonical.ts";
import { type AuthorizationContext, type AuthorizationDecision, type PolicyAction, type PolicyState } from "./policy.ts";
import { type BossAuthorizationContext, type BossAuthorizationDecision, type BossPolicyAction, type BossPolicyState } from "./boss-policy.ts";
import { type BossRunFeatureContract } from "./boss-wire.ts";
export declare const LEGACY_POLICY_ACTIONS: readonly PolicyAction[];
export type FeatureRegistrationState = "active" | "credential_only" | "unbound" | "revoked" | "replaced" | "ended";
export interface OrdinaryFeatureRegistration {
    principalId: string;
    principalClass: "ordinary";
    state: "active" | "revoked" | "ended";
}
export interface BossFeatureRegistration {
    principalId: string;
    principalClass: "boss-bound";
    state: FeatureRegistrationState;
    bossRunId: string;
    participantId: string;
    bindingEpoch: ParticipantBindingEpoch;
    featureContract: BossRunFeatureContract;
    policySemanticsHash: string;
    capabilityDigest: string;
    brokerIdentityVerified: boolean;
}
export type FeatureRegistration = OrdinaryFeatureRegistration | BossFeatureRegistration;
export interface FeatureAwarePolicyState {
    legacy: PolicyState;
    boss: BossPolicyState;
    registrations: Record<string, FeatureRegistration>;
}
export interface FeatureAwareAuthorizationRequest {
    actorId: string;
    targetId: string;
    action: PolicyAction | BossPolicyAction;
    legacyContext?: AuthorizationContext;
    bossContext?: BossAuthorizationContext;
}
export type FeatureAwareAuthorizationDecision = AuthorizationDecision | BossAuthorizationDecision | {
    allowed: false;
    code: "UNKNOWN_REGISTRATION" | "FEATURE_CLASS_DENIED" | "BINDING_INACTIVE" | "FEATURE_ATTESTATION_DENIED" | "ACTION_NAMESPACE_DENIED" | "CONTEXT_NAMESPACE_DENIED";
};
/** Exact parser for the broker's authoritative, principal-class-discriminated registration. */
export declare function parseFeatureRegistration(value: unknown, path?: string): FeatureRegistration;
/** Exact parser for routing requests; feature-class selection remains exclusively registration-derived. */
export declare function parseFeatureAwareAuthorizationRequest(value: unknown): FeatureAwareAuthorizationRequest;
/** Guarded compatibility boundary: calling frozen legacy authorization for a Boss registration is a programmer error. */
export declare function authorizeLegacyBoundary(state: FeatureAwarePolicyState, actorId: string, action: PolicyAction, targetId: string, context?: AuthorizationContext): AuthorizationDecision;
/** Derives routing only from authoritative registrations; request metadata cannot select or downgrade the policy namespace. */
export declare function authorizeFeatureAware(state: FeatureAwarePolicyState, requestValue: unknown): FeatureAwareAuthorizationDecision;
//# sourceMappingURL=feature-policy.d.ts.map