import { type PrismaAbility } from '@casl/prisma';
import type { AuthzContext } from '../context/authz-context';
import type { ResourceRegistry } from '../resource-registry';
import type { AbilityRule } from './snapshot.envelope';
export type Scope = 'GLOBAL' | 'TENANT' | 'OWN' | 'CONNECTED' | 'PROVIDER' | 'CUSTOMER';
export interface Grant {
    action: string;
    /** subject literal, or 'all' for the CASL wildcard (system tier). */
    subject: string;
    scope: Scope;
    /** field-level allow-list; empty/absent = all fields. */
    fields?: string[];
    inverted?: boolean;
}
/**
 * Grants → serialized CASL rules. GLOBAL scope (and the 'all' wildcard) emit no
 * conditions (unrestricted within the grant); every other scope pulls the manifest's
 * `scopes[scope]` template and substitutes the $ctx placeholders against `ctx`.
 */
export declare function buildRulesFromGrants(grants: Grant[], registry: ResourceRegistry, ctx: AuthzContext): AbilityRule[];
/** Rehydrate a PrismaAbility from serialized rules (snapshot → runtime). */
export declare function hydrateAbility(rules: AbilityRule[]): PrismaAbility<any>;
//# sourceMappingURL=ability-builder.d.ts.map