import { p as RbacStorage, r as RbacStorageRoleLookupCapability, q as RbacStorageMutationCapability, c as FindRoleInput, n as RbacRole, F as FindRoleByIdInput, i as ListRolesInput, v as UpsertRoleInput, D as DeleteRoleInput, G as GrantPermissionInput, s as RevokePermissionInput, h as ListRolePermissionsInput, b as AssignRoleStorageInput, o as RbacRoleBinding, u as RevokeRoleStorageInput, d as ListBindingsStorageInput, f as ListEffectiveRolesInput, j as RbacEffectiveRole, e as ListEffectivePermissionsInput, R as RbacEffectivePermission, C as CreateRoleInput, U as UpdateRoleInput, a as AssignRoleInput, t as RevokeRoleInput, g as ListPermissionsInput, L as ListBindingsInput } from './storage-bvOBdwf6.js';
import { b as RbacSubjectResolver, C as RbacTenantResolver, d as RbacCanInput, u as RbacServiceDecision } from './resolvers-BKIECWsa.js';
import { ModuleMetadata, FactoryProvider } from '@nestjs/common';
import { R as RbacAuditLogger } from './audit-BHpXBgZn.js';
import { a as RbacSubject, R as RbacResourceRef } from './subject-DTDyIu82.js';

interface RbacWriteValidationOptions {
    rejectTenantMismatch?: boolean | undefined;
    rejectResourceWithoutTenant?: boolean | undefined;
    rejectGlobalRoleInTenantBinding?: boolean | undefined;
}
type RbacTenantResolverMode = 'authoritative'
/** @deprecated Use the authoritative default and migrate request tenant sources. */
 | 'legacy-fallback';
type RbacPolicyChangeEventType = 'role.created' | 'role.updated' | 'role.deleted' | 'permission.granted' | 'permission.revoked' | 'role.assigned' | 'role.revoked';
interface RbacPolicyChangeEvent {
    type: RbacPolicyChangeEventType;
    occurredAt: Date;
    tenantId?: string | null | undefined;
    subject?: Pick<RbacSubject, 'type' | 'id'> | undefined;
    roleId?: string | undefined;
    roleKey?: string | undefined;
    permissions?: string[] | undefined;
    resource?: RbacResourceRef | undefined;
    bindingId?: string | undefined;
    metadata?: Record<string, unknown> | undefined;
}
interface RbacPolicyChangePublisher {
    publish(event: RbacPolicyChangeEvent): void | Promise<void>;
}
interface RbacModuleOptions {
    storage: RbacStorage;
    subjectResolver?: RbacSubjectResolver | undefined;
    tenantResolver?: RbacTenantResolver | undefined;
    auditLogger?: RbacAuditLogger | undefined;
    requireMetadata?: boolean | undefined;
    tenant?: {
        requiredByDefault?: boolean | undefined;
        allowGlobalRolesInTenant?: boolean | undefined;
        /**
         * Controls whether a configured tenantResolver is authoritative.
         * `legacy-fallback` preserves the pre-0.2.2 default-first behavior and is deprecated.
         */
        resolverMode?: RbacTenantResolverMode | undefined;
    } | undefined;
    storageErrors?: 'deny' | 'throw' | undefined;
    logAllowedDecisions?: boolean | undefined;
    writeValidation?: RbacWriteValidationOptions | undefined;
    changePublisher?: RbacPolicyChangePublisher | undefined;
    now?: (() => Date) | undefined;
}
interface RbacModuleAsyncOptions {
    imports?: ModuleMetadata['imports'];
    inject?: FactoryProvider<RbacModuleOptions>['inject'] | undefined;
    useFactory: FactoryProvider<RbacModuleOptions>['useFactory'];
}

declare class InMemoryRbacStorage implements RbacStorage, RbacStorageRoleLookupCapability {
    private roleSequence;
    private bindingSequence;
    private readonly roles;
    private readonly bindings;
    readonly mutationResults: RbacStorageMutationCapability;
    findRole(input: FindRoleInput): Promise<RbacRole | null>;
    findRoleById(input: FindRoleByIdInput): Promise<RbacRole | null>;
    listRoles(input: ListRolesInput): Promise<RbacRole[]>;
    upsertRole(input: UpsertRoleInput): Promise<RbacRole>;
    deleteRole(input: DeleteRoleInput): Promise<void>;
    grantPermission(input: GrantPermissionInput): Promise<void>;
    revokePermission(input: RevokePermissionInput): Promise<void>;
    listRolePermissions(input: ListRolePermissionsInput): Promise<string[]>;
    assignRole(input: AssignRoleStorageInput): Promise<RbacRoleBinding>;
    revokeRole(input: RevokeRoleStorageInput): Promise<void>;
    listBindings(input: ListBindingsStorageInput): Promise<RbacRoleBinding[]>;
    listEffectiveRoles(input: ListEffectiveRolesInput): Promise<RbacEffectiveRole[]>;
    listEffectivePermissions(input: ListEffectivePermissionsInput): Promise<RbacEffectivePermission[]>;
    private collectEffectiveRoles;
    private isEffectiveBinding;
    private toEffectiveRole;
    private findStoredRole;
    private findStoredBinding;
    private nextRoleId;
    private nextBindingId;
}

declare class RbacService {
    private readonly options;
    private readonly decisions;
    private readonly inputs;
    private readonly mutations;
    constructor(options: RbacModuleOptions);
    can(input: RbacCanInput): Promise<RbacServiceDecision>;
    assertCan(input: RbacCanInput): Promise<void>;
    createRole(input: CreateRoleInput): Promise<RbacRole>;
    updateRole(input: UpdateRoleInput): Promise<RbacRole>;
    deleteRole(input: DeleteRoleInput): Promise<void>;
    grantPermission(input: GrantPermissionInput): Promise<void>;
    revokePermission(input: RevokePermissionInput): Promise<void>;
    assignRole(input: AssignRoleInput): Promise<RbacRoleBinding>;
    revokeRole(input: RevokeRoleInput): Promise<void>;
    listRoles(input: ListRolesInput): Promise<RbacRole[]>;
    listPermissions(input: ListPermissionsInput): Promise<string[]>;
    listBindings(input: ListBindingsInput): Promise<RbacRoleBinding[]>;
    private canRole;
    private canPermission;
    private matchPermissions;
    private resolveAssignRoleIdentifier;
    private assignRoleNeedsResolvedRole;
    private findRoleById;
    private handleStorageError;
    private listEffectiveRolesForTenant;
    private listEffectivePermissionsForTenant;
    private validEffectiveRecords;
    private isValidEffectiveRecord;
}

export { InMemoryRbacStorage as I, type RbacModuleOptions as R, RbacService as a, type RbacModuleAsyncOptions as b, type RbacPolicyChangeEvent as c, type RbacPolicyChangeEventType as d, type RbacPolicyChangePublisher as e, type RbacTenantResolverMode as f, type RbacWriteValidationOptions as g };