/**
 * Type definitions for decorator options and configurations
 *
 * These types define the shape of configuration objects passed to decorators
 * and are used for static analysis and DAB configuration generation.
 */
import type { ClaimName, ClaimsDsl, ItemProxy, PolicyExpression } from './policy.js';
/**
 * The set of actions that a role can be granted on an entity.
 *
 * `'*'` grants all actions. Used by the `@role()` and `@authenticated()` decorators.
 */
export type SimpleAction = 'create' | 'read' | 'update' | 'delete' | 'execute' | '*';
/**
 * Field-level visibility for a role, restricting which fields the role can access.
 */
export interface FieldPermissions {
    /** Field names the role is allowed to access. When set, all other fields are excluded. */
    include?: string[];
    /** Field names the role is not allowed to access. */
    exclude?: string[];
}
/**
 * A row-level security policy expressed as a database predicate.
 */
export interface DatabasePolicy {
    /** The database policy expression applied to filter rows. */
    database: string;
}
/**
 * A row-level security policy applied to storage (blob) access.
 */
export interface StoragePolicy {
    /** The storage policy expression applied to authorize access. */
    storage: string;
}
/**
 * A row-level security policy, either a {@link DatabasePolicy} or a {@link StoragePolicy}.
 */
export type ActionPolicy = DatabasePolicy | StoragePolicy;
/**
 * A permission entry that pairs an action with optional field visibility and policy.
 */
export interface ComplexAction {
    /** The action being granted. */
    action: SimpleAction;
    /** Optional field-level visibility for this action. */
    fields?: FieldPermissions;
    /** Optional row-level security policy for this action. */
    policy?: ActionPolicy;
}
/**
 * A permission entry: either a bare {@link SimpleAction} or a {@link ComplexAction}
 * with field visibility and policy.
 */
export type PermissionAction = SimpleAction | ComplexAction;
/**
 * A map of role name to the permissions granted to that role.
 */
export interface PermissionConfig {
    [role: string]: PermissionAction[];
}
/**
 * Options for declaring a typed row-level security policy.
 *
 * @typeParam TEntity - The entity type the policy applies to.
 */
export interface PolicyOptions<TEntity extends object = object> {
    /**
     * Builds a policy expression from the request claims and the target item.
     *
     * @param claims - DSL for referencing the authenticated user's claims.
     * @param item - DSL for referencing the target item's fields.
     * @returns The policy expression evaluated to authorize the action.
     */
    check(claims: ClaimsDsl, item: ItemProxy<TEntity>): PolicyExpression;
}
/**
 * Options passed to the `@role()` and `@authenticated()` decorators.
 *
 * @typeParam TEntity - The entity type the role applies to.
 */
export interface RoleDeclarationOptions<TEntity extends object = object> {
    /**
     * Builds a typed row-level security policy from the request claims and target item.
     *
     * @param claims - DSL for referencing the authenticated user's claims.
     * @param item - DSL for referencing the target item's fields.
     * @returns The policy expression evaluated to authorize the action.
     */
    policy?(claims: ClaimsDsl, item: ItemProxy<TEntity>): PolicyExpression;
    /** Field names the role is allowed to access. When set, all other fields are excluded. */
    include?: (keyof TEntity)[];
    /** Field names the role is not allowed to access. */
    exclude?: (keyof TEntity)[];
}
/**
 * A fully-resolved role declaration stored in entity metadata.
 */
export interface RoleDeclaration {
    /** The role name (for example, `'authenticated'` or `'anonymous'`). */
    role: string;
    /** The actions granted to the role. */
    actions: SimpleAction[];
    /** Optional row-level security policy for the role. */
    policy?: PolicyOptions;
    /** Field names the role is allowed to access. */
    includedFields?: string[];
    /** Field names the role is not allowed to access. */
    excludedFields?: string[];
}
export type { ClaimName };
//# sourceMappingURL=options.d.ts.map