import { A as AuthzAction, M as MergedScope, E as EffectivePermission, C as ColumnScope, P as ParsedRowScope, a as MergedRowScope, R as RowScope } from "./types-BDKNZxPb.js";
export { b as AUTHZ_ACTIONS, c as ActionScope, D as DENY_ALL, d as MAX_SAFE_SCOPE_INTEGER, e as RESERVED_ROLE_ANONYMOUS, f as RESERVED_ROLE_AUTHENTICATED, g as RowFilter, h as columnScopeSchema, r as rowFilterSchema, i as rowScopeSchema } from "./types-BDKNZxPb.js";
import "zod";
type AdminGrantRow = {
    userId: number;
    roleId: number;
    grantId: number;
    action: AuthzAction;
    groupId?: number | null;
    tenantId: string;
};
type AdminRemoval = {
    removeRoleId?: number;
    removeAssignment?: {
        userId: number;
        roleId: number;
    };
    removeGroupAssignment?: {
        groupId: number;
        roleId: number;
    };
    removeGroupMembership?: {
        groupId: number;
        userId: number;
    };
    removeGroupId?: number;
    deactivateUserId?: number;
    removeGrantId?: number;
};
declare function fullAdmins(rows: AdminGrantRow[]): Set<number>;
declare function applyRemoval(rows: AdminGrantRow[], rm: AdminRemoval): AdminGrantRow[];
declare function wouldRemoveLastAdmin(rows: AdminGrantRow[], rm: AdminRemoval, tenantId: string): boolean;
declare function tenantsLosingLastAdmin(rows: AdminGrantRow[], rm: AdminRemoval): string[];
type AuthzRole = {
    id: number;
    roleKey: string;
    name: string;
    description: string | null;
    isActive: boolean;
    tenantId: string;
};
type AuthzResource = {
    id: number;
    appKey: string;
    resourceKey: string;
    name: string;
    description: string | null;
    tenantId: string;
};
type AuthzGrant = {
    id: number;
    roleId: number;
    roleKey: string;
    resourceId: number;
    appKey: string;
    resourceKey: string;
    action: AuthzAction;
    rowScope: string | null;
    columnScope: string | null;
};
type AuthzAssignment = {
    userId: number;
    email: string;
    displayName: string;
    roleId: number;
    roleKey: string;
};
type AuthzUser = {
    id: number;
    email: string;
    displayName: string;
};
type AuthzGroupRoleAssignment = {
    groupId: number;
    groupKey: string;
    groupName: string;
    roleId: number;
    roleKey: string;
};
type AuthzGroupSummary = {
    id: number;
    groupKey: string;
    name: string;
    tenantId: string;
};
type RoleInput = {
    tenantId: string;
    roleKey: string;
    name: string;
    description?: string | null;
};
type RoleUpdate = {
    tenantId: string;
    roleKey?: string;
    name: string;
    description?: string | null;
};
type ResourceInput = {
    tenantId: string;
    appKey: string;
    resourceKey: string;
    name: string;
    description?: string | null;
};
type ResourceUpdate = {
    name: string;
    description?: string | null;
};
type GrantInput = {
    tenantId: string;
    roleId: number;
    resourceId: number;
    action: AuthzAction;
    rowScope?: string | null;
    columnScope?: string | null;
};
type GrantUpdate = {
    action?: AuthzAction;
    rowScope?: string | null;
    columnScope?: string | null;
};
type SelfAdminContext = {
    actorUserId: number;
    selfAdminRoleIds: number[];
};
type LockoutOp = "disable-role" | "delete-role" | "delete-grant" | "remove-assignment" | "remove-group-role" | "remove-group-member" | "delete-group" | "deactivate-user";
type AuthzAdminStore<Runner = unknown> = {
    listRoles(tenantId: string): Promise<AuthzRole[]>;
    createRole(tenantId: string, input: RoleInput, actor: string): Promise<void>;
    updateRole(tenantId: string, id: number, input: RoleUpdate, actor: string): Promise<void>;
    setRoleActive(tenantId: string, id: number, isActive: boolean, actor: string): Promise<void>;
    deleteRole(tenantId: string, id: number): Promise<void>;
    listResources(tenantId: string): Promise<AuthzResource[]>;
    createResource(tenantId: string, input: ResourceInput, actor: string): Promise<void>;
    updateResource(tenantId: string, id: number, input: ResourceUpdate, actor: string): Promise<void>;
    deleteResource(tenantId: string, id: number): Promise<void>;
    listGrants(tenantId: string): Promise<AuthzGrant[]>;
    createGrant(tenantId: string, input: GrantInput, actor: string): Promise<void>;
    updateGrant(tenantId: string, id: number, input: GrantUpdate, actor: string): Promise<void>;
    deleteGrant(tenantId: string, id: number): Promise<void>;
    listUserRoles(tenantId: string): Promise<AuthzAssignment[]>;
    listUsers(tenantId: string): Promise<AuthzUser[]>;
    assignUserRole(tenantId: string, userId: number, roleId: number, actor: string): Promise<void>;
    removeUserRole(tenantId: string, userId: number, roleId: number): Promise<void>;
    listGroupRoles(tenantId: string): Promise<AuthzGroupRoleAssignment[]>;
    listGroups(tenantId: string): Promise<AuthzGroupSummary[]>;
    assignGroupRole(tenantId: string, groupId: number, roleId: number, actor: string): Promise<void>;
    removeGroupRole(tenantId: string, groupId: number, roleId: number): Promise<void>;
    getSelfAdminContext(tenantId: string, actorUserId: number): Promise<SelfAdminContext>;
    guardedWrite(tenantId: string, removal: AdminRemoval, op: LockoutOp, write: (run: Runner) => PromiseLike<unknown>): Promise<void>;
    withTransaction<T>(fn: (tx: AuthzAdminStore<Runner>, runner: Runner) => Promise<T>, options?: {
        isolationLevel?: "serializable";
    }): Promise<T>;
};
type Awaitable<T> = T | Promise<T>;
type PermissionQuery = {
    appKey: string;
    resourceKey: string;
    action: AuthzAction;
};
type DenyReason = "unresolved-user" | "no-permission" | "tenant-mismatch" | "not-a-tenant-member";
type DenyInfo = PermissionQuery & {
    reason: DenyReason;
    tenantId: string;
    userId: string | number | null;
};
type GuardResult<UserId extends string | number> = {
    userId: UserId | null;
    tenantId: string;
    scope: MergedScope;
    effectivePermission: EffectivePermission | null;
};
declare class AuthzDeniedError extends Error {
    readonly status = 403;
    readonly info: DenyInfo;
    constructor(info: DenyInfo);
}
type RequirePermissionDeps<Ctx, UserId extends string | number = string | number> = {
    resolveUserId: (ctx: Ctx) => Awaitable<UserId | null | undefined>;
    resolveTenantId: (ctx: Ctx) => Awaitable<string>;
    assertTenantMembership: (args: {
        ctx: Ctx;
        userId: UserId | null;
        tenantId: string;
    }) => Awaitable<boolean>;
    getEffectivePermissions: (args: {
        userId: UserId | null;
        tenantId: string;
        appKey: string;
        resourceKey: string;
    }) => Awaitable<EffectivePermission | null | undefined>;
    onDeny?: (info: DenyInfo) => void;
};
declare function createRequirePermission<Ctx, UserId extends string | number = string | number>(deps: RequirePermissionDeps<Ctx, UserId>): (ctx: Ctx, query: PermissionQuery) => Promise<GuardResult<UserId>>;
declare function parseRowScope(raw: string | null | undefined | RowScope): ParsedRowScope;
declare function parseColumnScope(raw: string | null | undefined | ColumnScope): ColumnScope | null;
declare function parseActionScope(stored: {
    rowScope: string | null | undefined | RowScope;
    columnScope: string | null | undefined | ColumnScope;
}): {
    rowScope: ParsedRowScope;
    columnScope: ColumnScope | null;
};
declare function mergeRowScopes(scopes: ParsedRowScope[]): MergedRowScope;
declare function mergeColumnScopes(scopes: (ColumnScope | null)[]): ColumnScope | null;
declare function isColumnAllowed(scope: ColumnScope | null, column: string): boolean;
declare function mergeScopes(scopes: {
    rowScope: ParsedRowScope;
    columnScope: ColumnScope | null;
}[]): MergedScope;
type PermissionGrant = {
    tenantId: string;
    action: AuthzAction;
    rowScope: string | null;
    columnScope: string | null;
};
declare function buildEffectivePermission(userId: string | number | null, grants: PermissionGrant[], tenantId: string): EffectivePermission;
declare function can(perm: EffectivePermission | null | undefined, action: AuthzAction): boolean;
declare function canWrite(perm: EffectivePermission | null | undefined): boolean;
declare const DENY_ALL_SCOPE: MergedScope;
type AuthzTenantErrorKind = "invalid-tenant" | "tenant-mismatch";
declare class AuthzTenantError extends Error {
    readonly kind: AuthzTenantErrorKind;
    constructor(kind: AuthzTenantErrorKind, message: string);
}
declare function isTenantId(value: unknown): value is string;
declare function assertTenantId(tenantId: string, context: string): string;
declare function isSameTenant(requestedTenantId: string, subjectTenantId: string): boolean;
declare function assertTenantMatch(requestedTenantId: string, subjectTenantId: string, context: string): void;
type GrantScopeInput = {
    action: string;
    rowScope?: string | null;
    columnScope?: string | null;
};
type ValidatedGrantScope = {
    action: AuthzAction;
    rowScope: string | null;
    columnScope: string | null;
};
declare function validateScopes(rowScope?: string | null, columnScope?: string | null): {
    rowScope: string | null;
    columnScope: string | null;
};
declare function validateGrantInput(input: GrantScopeInput): ValidatedGrantScope;
declare function validateRoleKey(roleKey: string): void;
export { type AdminGrantRow, type AdminRemoval, AuthzAction, type AuthzAdminStore, type AuthzAssignment, AuthzDeniedError, type AuthzGrant, type AuthzGroupRoleAssignment, type AuthzGroupSummary, type AuthzResource, type AuthzRole, AuthzTenantError, type AuthzTenantErrorKind, type AuthzUser, ColumnScope, DENY_ALL_SCOPE, type DenyInfo, type DenyReason, EffectivePermission, type GrantInput, type GrantScopeInput, type GrantUpdate, type GuardResult, type LockoutOp, MergedRowScope, MergedScope, ParsedRowScope, type PermissionGrant, type PermissionQuery, type RequirePermissionDeps, type ResourceInput, type ResourceUpdate, type RoleInput, type RoleUpdate, RowScope, type SelfAdminContext, type ValidatedGrantScope, applyRemoval, assertTenantId, assertTenantMatch, buildEffectivePermission, can, canWrite, createRequirePermission, fullAdmins, isColumnAllowed, isSameTenant, isTenantId, mergeColumnScopes, mergeRowScopes, mergeScopes, parseActionScope, parseColumnScope, parseRowScope, tenantsLosingLastAdmin, validateGrantInput, validateRoleKey, validateScopes, wouldRemoveLastAdmin };