import type { IPermissionEvaluator, PermissionCompileContext, PermissionCompileResult, PermissionEvaluationContext } from '@authup/access';
import type { OAuth2TokenPermission } from '@authup/specs';
/**
 * The store's one permission evaluator for its whole lifetime. Consumers hold
 * on to `store.permissionEvaluator`, so a session commit swaps what it
 * DELEGATES to rather than the object itself: the evaluator built from the
 * catalog and the introspection's grants, or the name-only fallback for a
 * server predating `GET /authorization`. A reset denies everything.
 */
export declare class StorePermissionEvaluator implements IPermissionEvaluator {
    protected inner: IPermissionEvaluator;
    constructor();
    setEvaluator(evaluator: IPermissionEvaluator): void;
    setPermissions(permissions: OAuth2TokenPermission[]): void;
    reset(): void;
    evaluate(ctx: PermissionEvaluationContext): Promise<void>;
    evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
    preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
    preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
    compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
}
/**
 * An evaluator that denies every check, the state a session commits when its
 * authorization data could not be built at all. It is the name-only fallback
 * holding no grant, so nothing else has to know what denying looks like.
 */
export declare function createDenyAllPermissionEvaluator(): IPermissionEvaluator;
//# sourceMappingURL=permission-evaluator.d.ts.map