/**
 * Trellis Server — Permission Middleware
 *
 * Entity-level access control declared in ontology schemas.
 *
 * Permission rules are defined per entity type in `EntityDef.permissions`.
 * Rules are evaluated at the middleware layer before any mutation or query
 * reaches the kernel.
 *
 * @module trellis/server
 */
import type { AuthContext } from './auth.js';
import type { EntityRecord } from '../core/kernel/trellis-kernel.js';
/** A permission rule for a CRUD operation on an entity type. */
export type PermissionRule = 'public' | 'authenticated' | 'own' | {
    role: string;
} | {
    roles: string[];
} | {
    fn: (auth: AuthContext, entity: EntityRecord | null) => boolean;
};
/** Per-operation permission rules for an entity type. */
export interface PermissionsDef {
    read?: PermissionRule;
    create?: PermissionRule;
    update?: PermissionRule;
    delete?: PermissionRule;
}
/** Extended EntityDef that includes optional permissions. */
export interface EntityDefWithPermissions {
    name: string;
    permissions?: PermissionsDef;
}
/** Operation types checked against permissions. */
export type CrudOp = 'read' | 'create' | 'update' | 'delete';
/**
 * Registry mapping entity type names to their permission definitions.
 * Populated at server startup from ontology schemas.
 */
export declare class PermissionRegistry {
    private rules;
    private defaultRule;
    /**
     * Register permissions for an entity type.
     */
    register(entityType: string, permissions: PermissionsDef): void;
    /**
     * Set the fallback rule used when an entity type has no declared permissions.
     */
    setDefault(rule: PermissionRule): void;
    /**
     * Get the permission rule for a specific operation on an entity type.
     * Falls back to the default rule if not declared.
     */
    getRule(entityType: string, op: CrudOp): PermissionRule;
    /**
     * Check whether an auth context is allowed to perform an operation.
     */
    check(auth: AuthContext, entityType: string, op: CrudOp, entity?: EntityRecord | null): boolean;
    /**
     * Assert access — throws a PermissionError if denied.
     */
    assert(auth: AuthContext, entityType: string, op: CrudOp, entity?: EntityRecord | null): void;
}
export declare class PermissionError extends Error {
    auth: AuthContext;
    entityType: string;
    op: CrudOp;
    constructor(auth: AuthContext, entityType: string, op: CrudOp);
    toResponse(): {
        error: string;
        message: string;
        code: number;
    };
}
/** Common preset: read-public, write-authenticated */
export declare const PUBLIC_READ: PermissionsDef;
/** Common preset: full public access */
export declare const FULLY_PUBLIC: PermissionsDef;
/** Common preset: owner-only CRUD */
export declare const OWNER_ONLY: PermissionsDef;
/** Common preset: admin-only */
export declare const ADMIN_ONLY: PermissionsDef;
//# sourceMappingURL=permissions.d.ts.map