import type { VaultPolicy, ReAuthOperation, NoydbPolicyApi, NoydbPolicyDeps, NoydbPolicyFactory } from '../../kernel/types.js';
export declare class NoydbPolicy implements NoydbPolicyApi {
    private readonly deps;
    constructor(deps: NoydbPolicyDeps);
    /**
     * Touch the policy enforcer for a vault (records activity, resets
     * idle timer). Also touches the legacy session timer. No-op if no enforcer.
     */
    touchPolicy(vault?: string): void;
    /**
     * Check that a policy-guarded operation is permitted.
     * Throws `SessionPolicyError` if re-auth is required.
     */
    checkPolicyOperation(vault: string, op: ReAuthOperation): void;
    /**
     * Read the active policy for a vault. Loads from `_meta/policy` on
     * first call; subsequent calls hit the in-memory cache. Throws
     * `ValidationError` if the vault has not been opened.
     */
    getPolicy(vault: string): Promise<VaultPolicy>;
    /**
     * Replace the policy document at `_meta/policy` and update the
     * in-memory cache. Gated by the `enroll-user` policy (a policy
     * change is fundamentally a privilege-management action).
     */
    updatePolicy(vault: string, override: Partial<VaultPolicy>): Promise<VaultPolicy>;
    /** Read or persist the vault policy at `_meta/policy` on first open. */
    bootstrapPolicy(vault: string, opts?: {
        skipManagedCheck?: boolean;
    }): Promise<void>;
}
/**
 * Factory that builds the `NoydbPolicy` service. `createNoydb()`
 * pre-resolves this via a dynamic import (mirrors
 * `with-party/directory/user-envelope/api.js#createUserApi`) and threads
 * it through `NoydbOptions.policyFactory` so `Noydb`'s constructor can
 * build `this.policyManager` synchronously.
 */
export declare const createNoydbPolicy: NoydbPolicyFactory;