import { type AuthPredicate, type Diagnostic, type Phase } from "@aotter/mantle-spec";
import type { HandlerContext } from "../model/HandlerContext.js";
/**
 * Pure auth-predicate evaluator. Shared by `InvokeProcedureUseCase`
 * and `ExecuteViewUseCase` so the `requires.auth.all` semantics in the
 * manifest grammar produce identical runtime behavior across atoms.
 *
 * The closed `ctx.user` / `ctx.staff` / `ctx.auth` / `ctx.auth.scope`
 * vocabulary is enforced at parse time; this evaluator trusts the shape
 * and only checks against the live `HandlerContext`.
 *
 * Domain-pure: no IO, no port deps. Lives in `domain/service/` because
 * both the procedure and view use cases need it; placing it in either
 * use case would create a usecase→usecase coupling.
 */
export interface AuthRequires {
    readonly auth?: {
        readonly all: readonly AuthPredicate[];
    };
}
/**
 * Evaluate `requires.auth.all` against `ctx`. Returns `null` when
 * authorization passes (or no `requires.auth.all` is declared), or an
 * structured 401/403 Diagnostic naming the first failing predicate.
 */
export declare function evaluateAuthAll(requires: AuthRequires | undefined, ctx: HandlerContext, path: string, phase: Phase): Diagnostic | null;
export declare function evaluatePredicate(pred: AuthPredicate, ctx: HandlerContext): boolean;
export declare function describePredicate(pred: AuthPredicate): string;
//# sourceMappingURL=AuthPredicateEvaluator.d.ts.map