/**
 * Policy guards for runtime enforcement.
 *
 * Provides utilities to assert that operations have their required
 * policy constraints satisfied before execution.
 *
 * @module policy/guards
 *
 * @example
 * ```typescript
 * import { assertPolicyForOperation } from '@contractspec/lib.contracts-spec';
 *
 * // In a handler or middleware
 * assertPolicyForOperation(ctx, operation);
 * ```
 */
import type { AnyOperationSpec } from '../operations/operation';
import type { PolicyContext } from './context';
/** Result of a policy guard check. */
export interface PolicyGuardResult {
    /** Whether the guard passed. */
    allowed: boolean;
    /** Reason for denial if guard failed. */
    reason?: string;
    /** Missing requirements if guard failed. */
    missing?: {
        roles?: string[];
        permissions?: string[];
        flags?: string[];
    };
}
/**
 * Check if an operation's policy constraints are satisfied.
 *
 * @param ctx - Policy context to check against
 * @param operation - Operation spec to check
 * @param flags - Available feature flags
 * @returns Guard result indicating if operation is allowed
 *
 * @example
 * ```typescript
 * const result = checkPolicyForOperation(ctx, myOperation, ['feature-x']);
 * if (!result.allowed) {
 *   console.log('Denied:', result.reason);
 * }
 * ```
 */
export declare function checkPolicyForOperation(ctx: PolicyContext, operation: AnyOperationSpec, flags?: string[]): PolicyGuardResult;
/**
 * Assert that an operation's policy constraints are satisfied.
 *
 * @param ctx - Policy context to check against
 * @param operation - Operation spec to check
 * @param flags - Available feature flags
 * @throws {PolicyViolationError} If policy is not satisfied
 *
 * @example
 * ```typescript
 * // Throws if policy not satisfied
 * assertPolicyForOperation(ctx, myOperation);
 *
 * // Safe to proceed with operation
 * await handler(input);
 * ```
 */
export declare function assertPolicyForOperation(ctx: PolicyContext, operation: AnyOperationSpec, flags?: string[]): void;
/**
 * Filter operations to only those with satisfied policy constraints.
 *
 * @param ctx - Policy context to check against
 * @param operations - Operations to filter
 * @param flags - Available feature flags
 * @returns Operations that have their policies satisfied
 */
export declare function filterOperationsByPolicy(ctx: PolicyContext, operations: AnyOperationSpec[], flags?: string[]): AnyOperationSpec[];
/**
 * Check if user has the required role for an operation.
 *
 * @param ctx - Policy context to check against
 * @param requiredRole - Role required for the operation
 * @param operation - Optional operation name for error messages
 * @returns Guard result
 */
export declare function checkRole(ctx: PolicyContext, requiredRole: string, operation?: string): PolicyGuardResult;
/**
 * Assert user has the required role.
 *
 * @param ctx - Policy context to check against
 * @param requiredRole - Role required
 * @param operation - Optional operation name for error messages
 * @throws {PolicyViolationError} If role is missing
 */
export declare function assertRole(ctx: PolicyContext, requiredRole: string, operation?: string): void;
/**
 * Check if user has any of the required roles.
 *
 * @param ctx - Policy context to check against
 * @param requiredRoles - Any of these roles is sufficient
 * @param operation - Optional operation name for error messages
 * @returns Guard result
 */
export declare function checkAnyRole(ctx: PolicyContext, requiredRoles: string[], operation?: string): PolicyGuardResult;
/**
 * Check if user has the required permission.
 *
 * @param ctx - Policy context to check against
 * @param requiredPermission - Permission required
 * @param operation - Optional operation name for error messages
 * @returns Guard result
 */
export declare function checkPermission(ctx: PolicyContext, requiredPermission: string, operation?: string): PolicyGuardResult;
/**
 * Assert user has the required permission.
 *
 * @param ctx - Policy context to check against
 * @param requiredPermission - Permission required
 * @param operation - Optional operation name for error messages
 * @throws {PolicyViolationError} If permission is missing
 */
export declare function assertPermission(ctx: PolicyContext, requiredPermission: string, operation?: string): void;
/**
 * Check if user has all of the required permissions.
 *
 * @param ctx - Policy context to check against
 * @param requiredPermissions - All of these permissions are required
 * @param operation - Optional operation name for error messages
 * @returns Guard result
 */
export declare function checkAllPermissions(ctx: PolicyContext, requiredPermissions: string[], operation?: string): PolicyGuardResult;
export interface CombinedPolicyRequirements {
    roles?: string[];
    anyRole?: string[];
    permissions?: string[];
    anyPermission?: string[];
    flags?: string[];
}
/**
 * Check multiple policy requirements at once.
 *
 * @param ctx - Policy context to check against
 * @param requirements - Combined requirements to check
 * @param flags - Available feature flags
 * @param operation - Optional operation name for error messages
 * @returns Guard result
 */
export declare function checkCombinedPolicy(ctx: PolicyContext, requirements: CombinedPolicyRequirements, flags?: string[], operation?: string): PolicyGuardResult;
/**
 * Assert multiple policy requirements at once.
 *
 * @param ctx - Policy context to check against
 * @param requirements - Combined requirements to check
 * @param flags - Available feature flags
 * @param operation - Optional operation name for error messages
 * @throws {PolicyViolationError} If any requirement is not met
 */
export declare function assertCombinedPolicy(ctx: PolicyContext, requirements: CombinedPolicyRequirements, flags?: string[], operation?: string): void;
