import { R as RbacModuleOptions, a as RbacService, b as RbacModuleAsyncOptions } from './rbac.service-CGsphCvC.js';
export { I as InMemoryRbacStorage, c as RbacPolicyChangeEvent, d as RbacPolicyChangeEventType, e as RbacPolicyChangePublisher, f as RbacTenantResolverMode, g as RbacWriteValidationOptions } from './rbac.service-CGsphCvC.js';
import { R as RbacAuditLogger, a as RbacAuditEvent } from './audit-BHpXBgZn.js';
import { R as RbacRequirementOptions, a as RbacBuiltInResourceDeclaration, b as RbacSubjectResolver } from './resolvers-BKIECWsa.js';
export { c as RbacCanBaseInput, d as RbacCanInput, e as RbacDecision, f as RbacDecisionDetails, g as RbacDecisionMatchDetails, h as RbacDecisionMissingDetails, i as RbacDecisionReason, j as RbacDecisionRequirementDetails, k as RbacEvaluationStep, l as RbacHeaderResourceDeclaration, m as RbacLegacyDecisionReason, n as RbacParamResourceDeclaration, o as RbacPermissionCanInput, p as RbacQueryResourceDeclaration, q as RbacRequirement, r as RbacRequirementMode, s as RbacResourceResolverFn, t as RbacRoleCanInput, u as RbacServiceDecision, v as RbacServiceDecisionDetails, w as RbacServiceDecisionMatchDetails, x as RbacServiceDecisionMissingDetails, y as RbacServiceDecisionReason, z as RbacServiceDecisionRequirementDetails, A as RbacServiceEvaluationStep, B as RbacTenantMode, C as RbacTenantResolver } from './resolvers-BKIECWsa.js';
import * as _nestjs_common from '@nestjs/common';
import { InternalServerErrorException, UnauthorizedException, ForbiddenException, CanActivate, ExecutionContext, DynamicModule } from '@nestjs/common';
export { A as AssignRoleBaseInput, a as AssignRoleInput, b as AssignRoleStorageInput, C as CreateRoleInput, D as DeleteRoleInput, F as FindRoleByIdInput, c as FindRoleInput, G as GrantPermissionInput, L as ListBindingsInput, d as ListBindingsStorageInput, e as ListEffectivePermissionsInput, f as ListEffectiveRolesInput, g as ListPermissionsInput, h as ListRolePermissionsInput, i as ListRolesInput, R as RbacEffectivePermission, j as RbacEffectiveRole, k as RbacMutationConflictReason, l as RbacMutationOutcome, m as RbacMutationResult, n as RbacRole, o as RbacRoleBinding, p as RbacStorage, q as RbacStorageMutationCapability, r as RbacStorageRoleLookupCapability, s as RevokePermissionInput, t as RevokeRoleInput, u as RevokeRoleStorageInput, U as UpdateRoleInput, v as UpsertRoleInput } from './storage-bvOBdwf6.js';
import { R as RbacResourceRef, a as RbacSubject } from './subject-DTDyIu82.js';
export { b as RbacResourceResolver, c as RbacResourceResolverToken, d as RbacResourceResolverTokenRef, e as RbacSubjectType } from './subject-DTDyIu82.js';
import { Reflector, ModuleRef } from '@nestjs/core';

declare const RBAC_OPTIONS: unique symbol;
declare const RBAC_STORAGE: unique symbol;
declare const RBAC_REQUIREMENTS_METADATA: unique symbol;
declare const RBAC_SKIP_METADATA: unique symbol;
declare const RBAC_SUBJECT_REQUEST_KEY = "rbacSubject";

declare class NoopRbacAuditLogger implements RbacAuditLogger {
    log(event: RbacAuditEvent): void;
}

/** Reads the subject stored by `RbacGuard` on the current Nest HTTP request. */
declare const CurrentRbacSubject: (...dataOrPipes: unknown[]) => ParameterDecorator;

declare const Can: (permission: string, options?: RbacRequirementOptions) => ClassDecorator & MethodDecorator;
declare const RequirePermission: (permission: string, options?: RbacRequirementOptions) => ClassDecorator & MethodDecorator;
declare const RequirePermissions: (permissions: readonly string[], options?: RbacRequirementOptions) => ClassDecorator & MethodDecorator;

declare const RequireRole: (roleKey: string, options?: RbacRequirementOptions) => ClassDecorator & MethodDecorator;

declare const SkipRbac: (reason?: string) => _nestjs_common.CustomDecorator<typeof RBAC_SKIP_METADATA>;

type RbacErrorCode = 'RBAC_CONFIG_ERROR' | 'RBAC_SUBJECT_MISSING' | 'RBAC_TENANT_MISSING' | 'RBAC_RESOURCE_MISSING' | 'RBAC_PERMISSION_DENIED' | 'RBAC_ROLE_NOT_FOUND' | 'RBAC_PERMISSION_NOT_FOUND' | 'RBAC_BINDING_NOT_FOUND' | 'RBAC_STORAGE_ERROR';
interface RbacErrorOptions {
    details?: Record<string, unknown> | undefined;
    cause?: unknown;
}
interface RbacErrorCauseOptions {
    cause?: unknown;
}
declare class RbacError extends Error {
    readonly code: RbacErrorCode;
    readonly status?: number | undefined;
    constructor(message: string, code: RbacErrorCode, status?: number | undefined, options?: RbacErrorOptions);
    readonly details?: Record<string, unknown>;
}
declare class RbacConfigError extends RbacError {
    constructor(details?: Record<string, unknown>, options?: RbacErrorCauseOptions);
}
declare class RbacSubjectMissingError extends RbacError {
    constructor(details?: Record<string, unknown>, options?: RbacErrorCauseOptions);
}
declare class RbacTenantMissingError extends RbacError {
    constructor(details?: Record<string, unknown>, options?: RbacErrorCauseOptions);
}
declare class RbacResourceMissingError extends RbacError {
    constructor(details?: Record<string, unknown>, options?: RbacErrorCauseOptions);
}
declare class RbacPermissionDeniedError extends RbacError {
    constructor(details?: Record<string, unknown>, options?: RbacErrorCauseOptions);
}
declare class RbacRoleNotFoundError extends RbacError {
    constructor(details?: Record<string, unknown>, options?: RbacErrorCauseOptions);
}
/**
 * @deprecated No package operation throws this error. It remains constructible
 * and HTTP-mappable until a separate breaking release.
 */
declare class RbacPermissionNotFoundError extends RbacError {
    constructor(details?: Record<string, unknown>, options?: RbacErrorCauseOptions);
}
/**
 * @deprecated No package operation throws this error. It remains constructible
 * and HTTP-mappable until a separate breaking release.
 */
declare class RbacBindingNotFoundError extends RbacError {
    constructor(details?: Record<string, unknown>, options?: RbacErrorCauseOptions);
}
declare class RbacStorageError extends RbacError {
    constructor(details?: Record<string, unknown>, options?: RbacErrorCauseOptions);
}

declare function mapRbacErrorToHttpException(error: RbacError): InternalServerErrorException | UnauthorizedException | ForbiddenException;

declare function createStrictRbacOptions(options: RbacModuleOptions): RbacModuleOptions;

interface RbacPermissionMetadata {
    description?: string | undefined;
    owner?: string | undefined;
    risk?: string | undefined;
}
interface DefineRbacPermissionsOptions {
    validateDuplicates?: boolean | undefined;
}
type PermissionMetadataKeys = keyof RbacPermissionMetadata;
type IsPermissionMetadata<T> = T extends object ? Extract<keyof T, PermissionMetadataKeys> extends never ? false : true : false;
type PermissionValueUnion<T> = T extends string ? T : T extends object ? {
    [K in keyof T]: IsPermissionMetadata<T[K]> extends true ? Extract<K, string> : PermissionValueUnion<T[K]>;
}[keyof T] : never;
type PermissionShape<T> = {
    readonly [K in keyof T]: T[K] extends string ? T[K] : IsPermissionMetadata<T[K]> extends true ? Extract<K, string> : PermissionShape<T[K]>;
};
type PermissionMetadataMap<T> = {
    readonly [K in Extract<keyof T, string> as IsPermissionMetadata<T[K]> extends true ? K : never]: T[K] extends RbacPermissionMetadata ? T[K] : never;
};
type RbacPermissionContract<T> = PermissionShape<T> & {
    readonly $permission: PermissionValueUnion<T>;
    readonly $permissions: PermissionValueUnion<T>[];
    readonly $metadata: PermissionMetadataMap<T>;
};
type PermissionDefinition = Record<string, unknown>;
declare function defineRbacPermissions<const T extends PermissionDefinition>(definition: T, options?: DefineRbacPermissionsOptions): RbacPermissionContract<T>;

/** Nest HTTP authorization guard. Other transports should call `RbacService` from their adapter. */
declare class RbacGuard implements CanActivate {
    private readonly reflector;
    private readonly options;
    private readonly audit;
    private readonly contextResolver;
    private readonly requirementEvaluator;
    constructor(reflector: Reflector, rbac: RbacService, options: RbacModuleOptions, moduleRef: ModuleRef);
    canActivate(context: ExecutionContext): Promise<boolean>;
}

declare class RbacModule {
    static forRoot(options: RbacModuleOptions): DynamicModule;
    static forRootAsync(options: RbacModuleAsyncOptions): DynamicModule;
}

declare const resolveHttpResource: (context: ExecutionContext, declaration: RbacBuiltInResourceDeclaration) => RbacResourceRef | undefined;

declare const defaultHttpSubjectResolver: () => RbacSubjectResolver;

declare const resolveHttpTenant: (context: ExecutionContext, requirementOptions: RbacRequirementOptions, subject: RbacSubject) => string | null | undefined;

declare function assertNonEmptyString(value: string | null | undefined, name: string): string;

declare function normalizePermission(permission: string): string;
declare function normalizePermissions(permissions: string[]): string[];

declare function matchesPermission(granted: string, required: string): boolean;

interface RbacStoredResourceRef {
    resourceType?: string | null | undefined;
    resourceId?: string | null | undefined;
}
declare function matchesResource(granted: RbacResourceRef | RbacStoredResourceRef | undefined, required: RbacResourceRef | undefined): boolean;

export { Can, CurrentRbacSubject, type DefineRbacPermissionsOptions, NoopRbacAuditLogger, RBAC_OPTIONS, RBAC_REQUIREMENTS_METADATA, RBAC_SKIP_METADATA, RBAC_STORAGE, RBAC_SUBJECT_REQUEST_KEY, RbacAuditEvent, RbacAuditLogger, RbacBindingNotFoundError, RbacBuiltInResourceDeclaration, RbacConfigError, RbacError, type RbacErrorCauseOptions, type RbacErrorCode, type RbacErrorOptions, RbacGuard, RbacModule, RbacModuleAsyncOptions, RbacModuleOptions, type RbacPermissionContract, RbacPermissionDeniedError, type RbacPermissionMetadata, RbacPermissionNotFoundError, RbacRequirementOptions, RbacResourceMissingError, RbacResourceRef, RbacRoleNotFoundError, RbacService, RbacStorageError, type RbacStoredResourceRef, RbacSubject, RbacSubjectMissingError, RbacSubjectResolver, RbacTenantMissingError, RequirePermission, RequirePermissions, RequireRole, SkipRbac, assertNonEmptyString, createStrictRbacOptions, defaultHttpSubjectResolver, defineRbacPermissions, mapRbacErrorToHttpException, matchesPermission, matchesResource, normalizePermission, normalizePermissions, resolveHttpResource, resolveHttpTenant };