import type { IPermissionEvaluator } from '../evaluator';
import type { RecordEvaluationContext, RecordUpdateEvaluationContext } from './types';
/**
 * Throws a permission error unless `name` passes for the record: each grant's
 * `realm_scope` is matched against the record's realm and its policies are
 * evaluated against the record. An array of names must ALL pass, like
 * `evaluate()`.
 */
export declare function evaluateRecord(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<void>;
/** {@link evaluateRecord} where ANY of the names suffices, like `evaluateOneOf()`. */
export declare function evaluateRecordOneOf(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<void>;
/**
 * {@link evaluateRecord} as a predicate. Only a permission error reads as
 * `false`; anything else propagates, so a failure on the authorization path
 * never turns into a quiet "not authorized".
 */
export declare function reachesRecord(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<boolean>;
/** {@link evaluateRecordOneOf} as a predicate, like {@link reachesRecord}. */
export declare function reachesRecordOneOf(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<boolean>;
/**
 * An update passes only when `name` passes for BOTH the stored row (the actor
 * may only change a row it can already reach) and the updated row (the row
 * must stay in reach afterwards). Evaluating the updated row alone lets an
 * update move a row INTO reach.
 */
export declare function evaluateRecordUpdate(evaluator: IPermissionEvaluator, ctx: RecordUpdateEvaluationContext): Promise<void>;
/**
 * Whether a grant of `name` (any of, for an array) reaches every realm with
 * no narrowing policy, i.e. `realm_scope: any`. Reads the `compile()`
 * verdict, so it relies on the binding policy (`system.default`) being bound
 * to the permission: without it a grant's reach is never evaluated and any
 * grant compiles to `allow`. Fail-closed: a policy-bearing `any` grant
 * compiles to `conditional` and reads as `false`.
 */
export declare function hasUnboundedReach(evaluator: IPermissionEvaluator, name: string | string[]): Promise<boolean>;
//# sourceMappingURL=module.d.ts.map