import { Effect } from 'effect';
import { ScopeError } from '@voltro/protocol';
import { Subject } from '@voltro/protocol';

/**
 * Effect-form OR guard. Passes if the caller holds AT LEAST ONE of the
 * listed permissions. Fails `ScopeError` (naming the first option) when it
 * holds none. The `admin:full` bypass passes.
 *
 * ```ts
 * yield* anyPermission(ctx, ['notes:write', 'notes:admin'])
 * ```
 */
export declare const anyPermission: (ctx: RbacContext, required: ReadonlyArray<string>) => Effect.Effect<void, ScopeError>;

/**
 * Sync-form guard for async (non-Effect) handlers. THROWS `ScopeError`
 * when the caller lacks the required permission(s). Array = AND.
 *
 * ```ts
 * const execute = async (input, ctx) => {
 *   assertPermission(ctx, 'notes:write')
 *   return ctx.store.insert('notes', { ... })
 * }
 * ```
 */
export declare const assertPermission: (ctx: RbacContext, required: string | ReadonlyArray<string>) => void;

/** Pure boolean check — no throw, no Effect. For branching inside a handler. */
export declare const can: (ctx: RbacContext, required: string | ReadonlyArray<string>) => boolean;

/**
 * Effect-form guard. Fails with a typed `ScopeError` on the error channel
 * when the caller lacks the required permission(s). An array means ALL
 * are required (AND). The `admin:full` bypass passes everything.
 *
 * ```ts
 * export default (input, ctx) => Effect.gen(function* () {
 *   yield* permission(ctx, 'notes:write')
 *   // ...
 * })
 * ```
 */
export declare const permission: (ctx: RbacContext, required: string | ReadonlyArray<string>) => Effect.Effect<void, ScopeError>;

/**
 * Anything carrying a resolved subject under `ctx.request.subject` — the
 * shape every handler executor receives (`AppContext`). Kept structural
 * so rbac needs no dependency on @voltro/runtime.
 */
export declare interface RbacContext {
    readonly request: {
        readonly subject: Subject;
    };
}

export { }