/**
 * Transport-neutral authorization policy types and the pipeline access check.
 *
 * Hosts the `AccessPolicy` / `ScopeRequirement` discriminated unions and
 * `evaluateAccess`, the function `executeOperation` calls between the
 * authentication step and the operation invocation. The scope vocabulary
 * and JWT claim extraction live in `authorization-scope.ts` — separated to
 * keep `principal.ts` and this file cycle-free. This stable authorization
 * policy model ensures consistent access control across REST and JSON-RPC
 * transports.
 */
import { type AuthorizationScope } from './authorization-scope.ts';
import { type Principal } from './principal.ts';
/** Non-empty tuple of authorization scopes. Prevents `anyOf([])` / `allOf([])` at the type level. */
export type ScopeRequirement = {
    kind: 'anyOf';
    scopes: [AuthorizationScope, ...AuthorizationScope[]];
} | {
    kind: 'allOf';
    scopes: [AuthorizationScope, ...AuthorizationScope[]];
};
/** The only representable access policies for an operation. Invalid combinations are unrepresentable. */
export type AccessPolicy = {
    kind: 'public';
} | {
    kind: 'authenticated';
} | {
    kind: 'scoped';
    scopes: ScopeRequirement;
} | {
    kind: 'scopedAlternatives';
    alternatives: [ScopeRequirement, ...ScopeRequirement[]];
} | {
    kind: 'optionalAuth';
    authenticatedScopes: ScopeRequirement;
};
/**
 * Result of a pipeline access check. Denials carry a classification so the
 * caller can emit the correct `Unauthorized` vs `Forbidden` fault.
 */
export type AccessCheckResult = {
    allowed: true;
} | {
    allowed: false;
    classification: 'unauthorized' | 'forbidden';
    reason: string;
};
/**
 * Evaluate an `AccessPolicy` against the caller's principal. This is the
 * pipeline step that translates the declarative policy into a pass/fail
 * decision. Credential *validation* happens at the transport edge, BEFORE
 * this function runs; by the time we're here, the principal shape tells us
 * whether the caller is authenticated.
 */
export declare function evaluateAccess(policy: AccessPolicy, principal: Principal): AccessCheckResult;