export declare const POLICY_SEMANTICS_VERSION = 2;
export type PolicyAction = "discover" | "send" | "ask" | "reply" | "inspect_tree" | "delegate_child" | "revoke" | "adopt";
export type PrincipalKind = "local" | "remote";
export type PrincipalState = "active" | "revoked";
export type PrincipalPolicy = "local-public" | "remote-tree";
export interface PolicyPrincipal {
    id: string;
    kind: PrincipalKind;
    state: PrincipalState;
    generation: number;
    policy: PrincipalPolicy;
    parentSessionId?: string;
    rootSessionId: string;
}
export interface PolicyState {
    principals: Record<string, PolicyPrincipal>;
}
export interface AuthorizationContext {
    actorGeneration?: number;
    targetGeneration?: number;
}
export type AuthorizationDenialCode = "UNKNOWN_PRINCIPAL" | "REVOKED_PRINCIPAL" | "STALE_GENERATION" | "POLICY_DENIED";
export type AuthorizationDecision = {
    allowed: true;
    reason: "self" | "local-public" | "direct-parent" | "ancestor-chain" | "ancestor-control";
} | {
    allowed: false;
    code: AuthorizationDenialCode;
};
export declare function isDirectParentPair(left: PolicyPrincipal, right: PolicyPrincipal): boolean;
export declare function isAncestor(state: PolicyState, ancestorId: string, descendantId: string): boolean;
export declare function authorize(state: PolicyState, actorId: string, action: PolicyAction, targetId: string, context?: AuthorizationContext): AuthorizationDecision;
export interface PolicyTransitionResult {
    state: PolicyState;
    changedPrincipalIds: string[];
}
export declare function revokeSubtree(state: PolicyState, principalId: string): PolicyTransitionResult;
export declare function adoptSubtree(state: PolicyState, principalId: string, newParentSessionId: string, newRootSessionId: string): PolicyTransitionResult;
//# sourceMappingURL=policy.d.ts.map