/**
 * This Source Code is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * Copyright (c) Infonomic Company Limited
 */
/**
 * Process-wide realm markers.
 *
 * `Symbol.for` is deliberate: a development server can retain an actor made
 * by one module generation while hot reload installs another. Class identity
 * changes across those generations, so `instanceof` rejects the still-valid
 * actor. The global symbol registry gives every generation the same marker
 * without weakening the admin/user distinction to a structural property such
 * as `id` or `abilities`, which both realms share.
 */
declare const ADMIN_AUTH_MARKER: unique symbol;
declare const USER_AUTH_MARKER: unique symbol;
/**
 * Admin-realm identity. Constructed by the session provider's
 * `resolveActor()` method, which joins roles → permissions into the
 * flat ability set.
 *
 * `isSuperAdmin` short-circuits every ability check. It mirrors the
 * `is_super_admin` flag on the `admin_users` row (see Phase 2 schema).
 */
export declare class AdminAuth {
    readonly [ADMIN_AUTH_MARKER] = true;
    readonly id: string;
    readonly abilities: ReadonlySet<string>;
    readonly isSuperAdmin: boolean;
    constructor(params: {
        id: string;
        abilities: Iterable<string>;
        isSuperAdmin?: boolean;
    });
    /** Non-throwing check. Super-admins always return `true`. */
    hasAbility(ability: string): boolean;
    /**
     * Throwing check. Throws `ERR_FORBIDDEN` when the actor lacks the
     * ability. Super-admins bypass. Primary enforcement call site once
     * service-layer enforcement (`document-lifecycle` / `IDocumentQueries`)
     * is wired in.
     */
    assertAbility(ability: string, message?: string): void;
    /**
     * Throwing check for a set of abilities (AND semantics — every listed
     * ability must be held). Super-admins bypass.
     */
    assertAbilities(abilities: readonly string[], messageFor?: (ability: string) => string): void;
}
/**
 * End-user / app-side identity. Stubbed in Phase 0 — the class exists so
 * `Actor` can discriminate between realms without later breaking
 * signatures, but the ability surface is deliberately minimal.
 *
 * Fleshed out when an end-user sign-in surface is actually needed. Until
 * then, assume no call path constructs a `UserAuth` instance in practice.
 */
export declare class UserAuth {
    readonly [USER_AUTH_MARKER] = true;
    readonly id: string;
    readonly abilities: ReadonlySet<string>;
    constructor(params: {
        id: string;
        abilities?: Iterable<string>;
    });
    hasAbility(ability: string): boolean;
    assertAbility(ability: string, message?: string): void;
}
/**
 * Canonical actor shape carried on `RequestContext`. `null` represents an
 * unauthenticated request — permitted only on public read paths once
 * service-layer enforcement is in place.
 */
export type Actor = AdminAuth | UserAuth | null;
/** Narrow an `Actor` to the admin realm. */
export declare function isAdminAuth(actor: Actor): actor is AdminAuth;
/** Narrow an `Actor` to the end-user realm. */
export declare function isUserAuth(actor: Actor): actor is UserAuth;
export {};