/**
 * Allowed HTTP methods in a policy rule.
 */
export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
/**
 * A time window restricting when a rule is active.
 */
export interface TimeWindow {
    /** Start time in HH:MM 24-hour format */
    start: string;
    /** End time in HH:MM 24-hour format */
    end: string;
    /** IANA timezone (e.g. "UTC", "America/New_York"). Defaults to "UTC". */
    timezone: string;
}
/**
 * A single policy rule — defines what an agent can do with a specific service.
 */
export interface PolicyRule {
    /** The service name this rule applies to (must match a credential's service) */
    service: string;
    /** Allowed HTTP methods. If omitted, all methods are allowed. */
    methods?: HttpMethod[];
    /** Allowed path patterns (regex strings). If omitted, all paths are allowed. */
    paths?: string[];
    /** Rate limit for this rule (e.g. "100/hour", "50/min"). Overrides credential-level limit. */
    rateLimit?: string;
    /** Optional time window restricting when this rule is active */
    timeWindow?: TimeWindow;
}
/**
 * A complete policy — binds an agent name to a set of rules.
 */
export interface Policy {
    /** The agent name this policy applies to */
    agent: string;
    /** The set of rules defining what this agent can do */
    rules: PolicyRule[];
}
/**
 * A validation error found when parsing or validating a policy file.
 */
export interface PolicyValidationError {
    /** The file path (if loaded from a file) */
    file?: string;
    /** Human-readable description of the error */
    message: string;
    /** The path to the offending field (e.g. "rules[0].methods[2]") */
    path?: string;
}
/**
 * Result of validating a policy (or set of policies).
 */
export interface PolicyValidationResult {
    valid: boolean;
    errors: PolicyValidationError[];
    /** The parsed policy, if valid */
    policy?: Policy;
    /** The source file path, if loaded from a file */
    filePath?: string;
}
/**
 * Parse and validate a raw YAML string into a Policy.
 * Returns a validation result with errors (if any) and the parsed policy (if valid).
 */
export declare function parsePolicy(yamlContent: string, filePath?: string): PolicyValidationResult;
/**
 * Load and validate a single policy file from disk.
 */
export declare function loadPolicyFile(filePath: string): PolicyValidationResult;
/**
 * Load all policy files from a directory (*.yaml and *.yml).
 * Returns an array of validation results, one per file.
 */
export declare function loadPoliciesFromDirectory(dirPath: string): PolicyValidationResult[];
/**
 * Build a map of agent name → Policy from a set of validation results.
 * Only includes valid policies.
 */
export declare function buildPolicyMap(results: PolicyValidationResult[]): Map<string, Policy>;
/**
 * The result of evaluating a request against a policy.
 */
export interface PolicyEvaluation {
    /** Whether the request is allowed by the policy */
    allowed: boolean;
    /** The specific rule that matched (if any) */
    matchedRule?: PolicyRule;
    /** If denied, the reason for the denial */
    reason?: string;
    /** The specific constraint that was violated (method, path, time_window, no_matching_rule) */
    violation?: 'method' | 'path' | 'time_window' | 'no_matching_rule';
}
/**
 * A request context to evaluate against a policy.
 */
export interface PolicyRequest {
    /** The service being accessed */
    service: string;
    /** The HTTP method */
    method: string;
    /** The request path (the part after /{service}/) */
    path: string;
    /** The current time — injectable for testing (defaults to new Date()) */
    now?: Date;
}
/**
 * Evaluate a request against a policy.
 *
 * Rules are matched by service name. If no rule matches the service,
 * the request is denied. If a rule matches, method and path constraints
 * are checked. If multiple rules match the same service, the request is
 * allowed if ANY rule permits it.
 *
 * Returns an evaluation result indicating whether the request is allowed
 * and, if not, why.
 */
export declare function evaluatePolicy(policy: Policy, request: PolicyRequest): PolicyEvaluation;
//# sourceMappingURL=policy.d.ts.map