import type { FederationClaimType, PolicyEngineDeps } from './policy-engine.js';
export type FederationAuthorizationMode = 'legacy' | 'observe' | 'enforce';
export interface FederationClaimCheckerConfig {
    mode?: FederationAuthorizationMode;
    grantedClaims?: readonly string[];
    onObservation?: (claim: FederationClaimType, granted: boolean) => void;
}
export interface FederationClaimChecker {
    mode: FederationAuthorizationMode;
    grantedClaims: ReadonlySet<FederationClaimType>;
    checkClaim: PolicyEngineDeps['checkClaim'];
}
/**
 * Compatibility bridge for the legacy federation policy engine.
 *
 * This removes the anonymous `() => true` production stub and makes
 * compatibility behavior explicit:
 * - legacy: preserve pre-ADR-325 behavior;
 * - observe: calculate and report missing grants without blocking;
 * - enforce: default deny unless the exact claim is configured.
 *
 * ADR-324 policy adapters can supply the `grantedClaims` set after evaluating
 * the request; ownership-changing federation messages remain disabled in the
 * default message policy until the full ingress PEP is composed.
 */
export declare function createFederationClaimChecker(config?: FederationClaimCheckerConfig): FederationClaimChecker;
//# sourceMappingURL=claim-checker.d.ts.map