/** Header carrying an opaque WebAuthn step-up assertion on a tunneled request. */
export declare const STEP_UP_ASSERTION_HEADER = "x-goodvibes-stepup-assertion";
/**
 * Verifies a step-up assertion. Returns true only on genuine verification.
 * Consumers wire a real WebAuthn verifier here; until then the policy fails
 * closed. `context` carries the request essentials a verifier binds against.
 */
export type StepUpAssertionVerifier = (assertion: string, context: {
    readonly method: string;
    readonly path: string;
}) => Promise<boolean>;
/** The outcome of a step-up policy evaluation. */
export type StepUpDecision = {
    readonly allow: true;
} | {
    readonly allow: false;
    readonly code: 'step-up-required' | 'step-up-verifier-unavailable';
    readonly message: string;
};
/** Inputs to a step-up evaluation, all already-resolved facts, so this is pure. */
export interface StepUpEvaluationInput {
    /** Did the request arrive over the relay (vs the trusted LAN)? */
    readonly viaRelay: boolean;
    /** Is the call state-changing (mutating verb)? */
    readonly mutating: boolean;
    /** Is the step-up requirement switched on? */
    readonly requireStepUp: boolean;
    /**
     * Verification result: true = genuinely verified, false = present-but-invalid
     * or absent, null = no verifier available (fail closed).
     */
    readonly assertionVerified: boolean | null;
}
/**
 * Whether an HTTP method is mutating. This mirrors the operator catalog, where
 * read-only methods carry `read:<domain>` scope and a GET binding while mutating
 * methods carry `write:<domain>` and a POST/PUT/PATCH/DELETE binding.
 */
export declare function isMutatingMethod(method: string): boolean;
/**
 * Decide whether a request may proceed. The control only bites on mutating
 * relay calls when the requirement is enabled; every other request is allowed
 * unchanged. When it does bite, it fails closed unless a verifier genuinely
 * confirmed a fresh assertion.
 */
export declare function evaluateStepUp(input: StepUpEvaluationInput): StepUpDecision;
//# sourceMappingURL=step-up-policy.d.ts.map