/**
 * IoT Policy Validator Module
 *
 * Provides functionality to validate IoT policies for developer isolation
 * and verify that cross-developer access is properly denied.
 *
 * @module core/runtime-web/runtime-awake/iot-policy-validator
 *
 * @see Requirements 3.3, 3.4, 3.5
 */
/**
 * IoT policy statement structure.
 */
export interface IoTPolicyStatement {
    /** Effect: Allow or Deny */
    readonly Effect: 'Allow' | 'Deny';
    /** Actions (e.g., 'iot:Connect', 'iot:Publish') */
    readonly Action: string | string[];
    /** Resource ARN patterns */
    readonly Resource: string | string[];
    /** Optional condition block */
    readonly Condition?: Record<string, Record<string, string | string[]>>;
}
/**
 * IoT policy document structure.
 */
export interface IoTPolicyDocument {
    /** Policy version */
    readonly Version: string;
    /** Policy statements */
    readonly Statement: IoTPolicyStatement[];
}
/**
 * Topic pattern for Live Dev MQTT communication.
 */
export declare const LIVE_DEV_TOPIC_PATTERN = "runtime/dev/{devId}/*";
/**
 * IoT actions used by Live Dev.
 */
export declare const LIVE_DEV_IOT_ACTIONS: {
    readonly CONNECT: "iot:Connect";
    readonly SUBSCRIBE: "iot:Subscribe";
    readonly PUBLISH: "iot:Publish";
    readonly RECEIVE: "iot:Receive";
};
/**
 * Result of policy validation.
 */
export interface PolicyValidationResult {
    /** Whether the policy is valid for developer isolation */
    readonly isValid: boolean;
    /** Validation errors (if any) */
    readonly errors: string[];
    /** Validation warnings (if any) */
    readonly warnings: string[];
    /** Developer ID the policy is scoped to */
    readonly scopedDevId: string | null;
}
/**
 * Result of topic access check.
 */
export interface TopicAccessResult {
    /** Whether access is allowed */
    readonly allowed: boolean;
    /** Reason for the decision */
    readonly reason: string;
    /** Matching statement (if any) */
    readonly matchingStatement?: IoTPolicyStatement;
}
/**
 * Extract devId from a topic pattern.
 *
 * @param topicPattern - Topic pattern (e.g., 'runtime/dev/john-doe/*')
 * @returns Extracted devId or null if not found
 */
export declare function extractDevIdFromTopicPattern(topicPattern: string): string | null;
/**
 * Extract devId from a resource ARN.
 *
 * @param resourceArn - Resource ARN (e.g., 'arn:aws:iot:us-east-1:123456789012:topic/runtime/dev/john-doe/*')
 * @returns Extracted devId or null if not found
 */
export declare function extractDevIdFromResourceArn(resourceArn: string): string | null;
/**
 * Check if a topic matches a topic pattern.
 *
 * Supports MQTT wildcards:
 * - '+' matches a single level
 * - '#' matches multiple levels (must be at end)
 * - '*' is treated as '#' for compatibility
 *
 * @param topic - Actual topic (e.g., 'runtime/dev/john-doe/request/abc123')
 * @param pattern - Topic pattern (e.g., 'runtime/dev/john-doe/*')
 * @returns True if topic matches pattern
 */
export declare function topicMatchesPattern(topic: string, pattern: string): boolean;
/**
 * Check if a resource ARN matches a topic.
 *
 * @param resourceArn - Resource ARN pattern
 * @param topic - Topic to check
 * @returns True if ARN matches topic
 */
export declare function resourceArnMatchesTopic(resourceArn: string, topic: string): boolean;
/**
 * Check if a client ID matches a client ARN pattern.
 *
 * @param clientArn - Client ARN pattern (e.g., 'arn:aws:iot:...:client/john-doe-*')
 * @param clientId - Client ID to check
 * @returns True if client ID matches pattern
 */
export declare function clientArnMatchesClientId(clientArn: string, clientId: string): boolean;
/**
 * Validate that an IoT policy properly isolates a developer.
 *
 * Checks that:
 * 1. Connect action is restricted to devId-prefixed client IDs
 * 2. Subscribe action is restricted to devId's topic namespace
 * 3. Publish action is restricted to devId's topic namespace
 * 4. Receive action is restricted to devId's topic namespace
 *
 * @param policy - IoT policy document
 * @param expectedDevId - Expected developer ID
 * @returns Validation result
 *
 * @see Requirements 3.3, 3.4
 */
export declare function validateDeveloperIsolationPolicy(policy: IoTPolicyDocument, expectedDevId: string): PolicyValidationResult;
/**
 * Check if a policy allows access to a specific topic for a given action.
 *
 * @param policy - IoT policy document
 * @param action - IoT action (e.g., 'iot:Publish')
 * @param topic - Topic to check access for
 * @returns Access result
 */
export declare function checkTopicAccess(policy: IoTPolicyDocument, action: string, topic: string): TopicAccessResult;
/**
 * Check if a policy allows a client to connect with a specific client ID.
 *
 * @param policy - IoT policy document
 * @param clientId - Client ID to check
 * @returns Access result
 */
export declare function checkConnectAccess(policy: IoTPolicyDocument, clientId: string): TopicAccessResult;
/**
 * Verify that a policy denies cross-developer access.
 *
 * Tests that a developer's policy does NOT allow access to another developer's topics.
 *
 * @param policy - IoT policy document for devId1
 * @param devId1 - Developer ID that owns the policy
 * @param devId2 - Developer ID to test cross-access for
 * @returns True if cross-access is properly denied
 *
 * @see Requirements 3.5
 */
export declare function verifyCrossDevAccessDenied(policy: IoTPolicyDocument, devId1: string, devId2: string): {
    denied: boolean;
    violations: string[];
};
/**
 * Generate a properly isolated IoT policy for a developer.
 *
 * Creates a policy that:
 * - Allows Connect only with devId-prefixed client IDs
 * - Allows Subscribe only to devId's topic namespace
 * - Allows Publish only to devId's topic namespace
 * - Allows Receive only from devId's topic namespace
 *
 * @param devId - Developer ID
 * @param region - AWS region
 * @param accountId - AWS account ID
 * @returns IoT policy document
 *
 * @see Requirements 3.3, 3.4
 */
export declare function generateIsolatedIoTPolicy(devId: string, region: string, accountId: string): IoTPolicyDocument;
/**
 * Validate that two developer topic namespaces do not overlap.
 *
 * @param devId1 - First developer ID
 * @param devId2 - Second developer ID
 * @returns True if namespaces are isolated (no overlap)
 *
 * @see Requirements 3.2
 */
export declare function validateTopicNamespaceIsolation(devId1: string, devId2: string): boolean;
/**
 * Get the topic namespace for a developer.
 *
 * @param devId - Developer ID
 * @returns Topic namespace pattern
 */
export declare function getDevTopicNamespace(devId: string): string;
/**
 * Check if a topic belongs to a developer's namespace.
 *
 * @param topic - Topic to check
 * @param devId - Developer ID
 * @returns True if topic is in developer's namespace
 */
export declare function isTopicInDevNamespace(topic: string, devId: string): boolean;
