/**
 * Typed policy builder DSL for Rayfin permissions.
 *
 * Used inside `@role()`/`@authenticated()` policy callbacks to express
 * row-level security rules with `claims` and `item`.
 *
 * @example
 * ```typescript
 * @authenticated('*', {
 *   check: (claims, item) => claims.sub.eq(item.user_id),
 * })
 * export class Todo {}
 * ```
 */
/**
 * The names of claims available on the authenticated user's token.
 *
 * - `sub` — the user's unique identifier.
 * - `email` — the user's email address.
 * - `role` — the user's role.
 */
export type ClaimName = 'sub' | 'email' | 'role';
/**
 * A composable policy expression that serializes to a DAB policy predicate.
 */
export interface PolicyExpression {
    /** Serializes the expression to its DAB policy string form. */
    toString(): string;
    /**
     * Combines this expression with another using logical AND.
     *
     * @param expr - The expression to AND with this one.
     * @returns A new combined expression.
     */
    and(expr: PolicyExpression): PolicyExpression;
    /**
     * Combines this expression with another using logical OR.
     *
     * @param expr - The expression to OR with this one.
     * @returns A new combined expression.
     */
    or(expr: PolicyExpression): PolicyExpression;
}
/** Supported comparison operators in policy expressions. */
export type ComparisonOperator = 'eq' | 'ne';
/** Supported logical operators in policy expressions. */
export type LogicalOperator = 'and' | 'or';
/**
 * Base class for policy expressions, providing the `and`/`or` combinators.
 */
export declare abstract class BaseExpression implements PolicyExpression {
    /** Serializes the expression to its DAB policy string form. */
    abstract toString(): string;
    /**
     * Combines this expression with another using logical AND.
     *
     * @param expr - The expression to AND with this one.
     * @returns A new combined expression.
     */
    and(expr: PolicyExpression): PolicyExpression;
    /**
     * Combines this expression with another using logical OR.
     *
     * @param expr - The expression to OR with this one.
     * @returns A new combined expression.
     */
    or(expr: PolicyExpression): PolicyExpression;
}
/**
 * A reference to a claim on the authenticated user's token (for example, `claims.sub`).
 *
 * @typeParam T - The claim name this reference points to.
 */
export declare class ClaimRef<T extends ClaimName = ClaimName> extends BaseExpression {
    readonly name: T;
    /**
     * @param name - The claim name this reference points to.
     */
    constructor(name: T);
    /**
     * Builds an equality comparison against the given value.
     *
     * @param value - The value or expression to compare against.
     * @returns A comparison expression (`claim eq value`).
     */
    eq(value: Operand): PolicyExpression;
    /**
     * Builds an inequality comparison against the given value.
     *
     * @param value - The value or expression to compare against.
     * @returns A comparison expression (`claim ne value`).
     */
    neq(value: Operand): PolicyExpression;
    /** Serializes the claim reference (for example, `@claims.sub`). */
    toString(): string;
}
/**
 * A reference to a field on the target item (for example, `item.user_id`).
 */
export declare class FieldRef extends BaseExpression {
    readonly name: string;
    /**
     * @param name - The field name this reference points to.
     */
    constructor(name: string);
    /**
     * Builds an equality comparison against the given value.
     *
     * @param value - The value or expression to compare against.
     * @returns A comparison expression (`field eq value`).
     */
    eq(value: Operand): PolicyExpression;
    /**
     * Builds an inequality comparison against the given value.
     *
     * @param value - The value or expression to compare against.
     * @returns A comparison expression (`field ne value`).
     */
    neq(value: Operand): PolicyExpression;
    /** Serializes the field reference (for example, `@item.user_id`). */
    toString(): string;
}
/**
 * A value that can appear on either side of a comparison: an expression,
 * primitive, `Date`, or `null`.
 */
export type Operand = BaseExpression | string | number | boolean | Date | null;
/**
 * A comparison between two operands (for example, `@claims.sub eq @item.user_id`).
 */
export declare class ComparisonExpression extends BaseExpression {
    readonly left: Operand;
    readonly operator: ComparisonOperator;
    readonly right: Operand;
    /**
     * @param left - The left-hand operand.
     * @param operator - The comparison operator.
     * @param right - The right-hand operand.
     */
    constructor(left: Operand, operator: ComparisonOperator, right: Operand);
    /** Serializes the comparison to its DAB policy string form. */
    toString(): string;
}
/**
 * A logical combination of two expressions (for example, `(...) and (...)`).
 */
export declare class LogicalExpression extends BaseExpression {
    readonly operator: LogicalOperator;
    readonly left: PolicyExpression;
    readonly right: PolicyExpression;
    /**
     * @param operator - The logical operator (`and` or `or`).
     * @param left - The left-hand expression.
     * @param right - The right-hand expression.
     */
    constructor(operator: LogicalOperator, left: PolicyExpression, right: PolicyExpression);
    /** Serializes the logical expression to its DAB policy string form. */
    toString(): string;
}
/**
 * A typed proxy over an entity's fields, exposing each field as a {@link FieldRef}
 * for use in policy expressions.
 *
 * @typeParam T - The entity type whose fields are exposed.
 */
export type ItemProxy<T = unknown> = (T extends object ? {
    [K in keyof T]-?: FieldRef;
} : {}) & {
    readonly [Symbol.toStringTag]?: 'ItemProxy';
};
/**
 * The DSL for referencing the authenticated user's claims in a policy expression.
 */
export type ClaimsDsl = {
    /** Reference to the `sub` (subject/user id) claim. */
    sub: ClaimRef<'sub'>;
    /** Reference to the `email` claim. */
    email: ClaimRef<'email'>;
    /** Reference to the `role` claim. */
    role: ClaimRef<'role'>;
};
/**
 * Creates an {@link ItemProxy} that resolves any accessed property to a {@link FieldRef}.
 *
 * @typeParam T - The entity type whose fields are exposed.
 * @returns A proxy where each field access yields a field reference.
 */
export declare function createItemProxy<T = unknown>(): ItemProxy<T>;
/**
 * The root claims DSL used inside policy callbacks (for example, `claims.sub.eq(...)`).
 */
export declare const claims: ClaimsDsl;
/**
 * A generic, untyped item proxy for convenience where a typed entity is not available.
 */
export declare const item: ItemProxy<Record<string, unknown>>;
//# sourceMappingURL=policy.d.ts.map