import type { VaultPolicy } from '../../kernel/types.js';
/**
 * Default policy for personal vaults and SMB deployments — the gates
 * that need an off-device factor get one (TOTP / email-OTP / paper
 * recovery), the rest take a tier-1 unlock alone. Tier-3 (PIN) is the
 * floor only for `rotate-unlock` because that's the
 * "change my PIN" flow.
 *
 * The unspecified gates (e.g. `view-user-auth`) inherit the engine
 * default of `{ enabled: false, minTier: 1 }` — they fail closed.
 *
 * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Built-in gates
 */
export declare const PERSONAL_POLICY: VaultPolicy;
/**
 * Strict policy for regulated deployments and shared workstations —
 * raises the phrase floor to 8 words, demands two distinct factors for
 * exports, and blocks export-on-shared-device. Use as a base for
 * `policy: { ...STRICT_POLICY, gates: { ...STRICT_POLICY.gates, ... } }`
 * tweaks.
 */
export declare const STRICT_POLICY: VaultPolicy;
/**
 * Merge a developer override onto a preset. Unspecified gates inherit;
 * specified gates fully replace the preset's entry for that gate.
 *
 * Example:
 *
 * ```ts
 * mergePolicy(PERSONAL_POLICY, {
 *   gates: {
 *     'app:approve-large-payment': { minTier: 2, factors: [{ anyOf: ['totp'] }] },
 *   },
 * })
 * // → PERSONAL_POLICY plus the new app gate; existing gates intact.
 * ```
 */
export declare function mergePolicy(base: VaultPolicy, override?: Partial<VaultPolicy>): VaultPolicy;