import { ExecutionContext } from '@nestjs/common';
import { a as RbacSubject, R as RbacResourceRef, c as RbacResourceResolverToken, d as RbacResourceResolverTokenRef } from './subject-DTDyIu82.js';

type RbacTenantMode = 'required' | 'optional' | 'none';
type RbacRequirementMode = 'any' | 'all';
interface RbacCanBaseInput {
    subject?: RbacSubject | undefined;
    tenantId?: string | null | undefined;
    tenantMode?: RbacTenantMode | undefined;
    resource?: RbacResourceRef | undefined;
    now?: Date | undefined;
}
type RbacPermissionCanInput = RbacCanBaseInput & ({
    permission: string;
    permissions?: string[] | undefined;
    roleKey?: never;
    mode?: RbacRequirementMode | undefined;
} | {
    permission?: undefined;
    permissions: string[];
    roleKey?: never;
    mode?: RbacRequirementMode | undefined;
});
type RbacRoleCanInput = RbacCanBaseInput & {
    roleKey: string;
    permission?: never;
    permissions?: never;
    mode?: never;
};
type RbacCanInput = RbacPermissionCanInput | RbacRoleCanInput;
/**
 * Compatibility envelope for decisions created by applications, tests, or older
 * package versions. `RbacService.can()` returns the narrower
 * `RbacServiceDecision` contract.
 */
interface RbacDecision {
    allowed: boolean;
    reason: RbacDecisionReason;
    subject?: RbacSubject | undefined;
    tenantId?: string | null | undefined;
    permission?: string | undefined;
    permissions?: string[] | undefined;
    roleKey?: string | undefined;
    mode?: RbacRequirementMode | undefined;
    matchedRoleKeys?: string[] | undefined;
    matchedPermissions?: string[] | undefined;
    resource?: RbacResourceRef | undefined;
    details?: RbacDecisionDetails | undefined;
}
/** A decision produced by `RbacService.can()`. */
type RbacServiceDecision = Omit<RbacDecision, 'reason' | 'details'> & {
    reason: RbacServiceDecisionReason;
    details: RbacServiceDecisionDetails;
};
interface RbacDecisionDetails {
    requirement?: RbacDecisionRequirementDetails | undefined;
    matched?: RbacDecisionMatchDetails | undefined;
    missing?: RbacDecisionMissingDetails | undefined;
    evaluationPath?: RbacEvaluationStep[] | undefined;
    safeMessage?: string | undefined;
}
/** Details that are always attached to decisions produced by `RbacService.can()`. */
interface RbacServiceDecisionDetails extends Omit<RbacDecisionDetails, 'requirement' | 'matched' | 'missing' | 'evaluationPath' | 'safeMessage'> {
    requirement?: RbacServiceDecisionRequirementDetails | undefined;
    matched?: RbacServiceDecisionMatchDetails | undefined;
    missing?: RbacServiceDecisionMissingDetails | undefined;
    evaluationPath: RbacServiceEvaluationStep[];
    safeMessage: RbacServiceDecisionReason;
}
type RbacServiceDecisionRequirementDetails = {
    type: 'permission';
    permissions: string[];
    mode: RbacRequirementMode;
} | {
    type: 'role';
    roleKeys: string[];
};
interface RbacServiceDecisionMatchDetails {
    roleKeys: string[];
    permissions?: string[] | undefined;
}
type RbacServiceDecisionMissingDetails = {
    subject: true;
} | {
    tenant: true;
} | {
    permissions: string[];
} | {
    roleKeys: string[];
};
interface RbacDecisionRequirementDetails {
    type: 'permission' | 'role';
    permissions?: string[] | undefined;
    roleKeys?: string[] | undefined;
    mode?: RbacRequirementMode | undefined;
}
interface RbacDecisionMatchDetails {
    /** @deprecated `RbacService` has never populated this compatibility field. */
    roleIds?: string[] | undefined;
    roleKeys?: string[] | undefined;
    permissions?: string[] | undefined;
    /** @deprecated `RbacService` has never populated this compatibility field. */
    bindingIds?: string[] | undefined;
}
interface RbacDecisionMissingDetails {
    subject?: boolean | undefined;
    tenant?: boolean | undefined;
    /** @deprecated `RbacService` reports resource failures before creating a decision. */
    resource?: boolean | undefined;
    permissions?: string[] | undefined;
    roleKeys?: string[] | undefined;
}
interface RbacEvaluationStep {
    code: 'subject_missing' | 'tenant_missing' | 'tenant_conflict' | 'resource_missing' | 'resource_mismatch' | 'roles_loaded' | 'permissions_loaded' | 'permission_matched' | 'permission_missing' | 'role_matched' | 'role_missing' | 'storage_error';
    outcome: 'allow' | 'deny' | 'skip' | 'info';
}
/** Evaluation steps that `RbacService.can()` can currently produce. */
type RbacServiceEvaluationStep = {
    code: 'role_matched' | 'permission_matched';
    outcome: 'allow';
} | {
    code: 'subject_missing' | 'tenant_missing' | 'tenant_conflict' | 'permission_missing' | 'role_missing' | 'storage_error';
    outcome: 'deny';
};
/** Decision reasons that `RbacService.can()` can currently produce. */
type RbacServiceDecisionReason = 'allowed_by_role' | 'allowed_by_role_permission' | 'denied_subject_missing' | 'denied_tenant_missing' | 'denied_tenant_conflict' | 'denied_no_matching_role' | 'denied_no_matching_permission' | 'denied_storage_error';
/**
 * @deprecated These values were exported by 0.2.x but have no
 * `RbacService.can()` producer. They remain in the compatibility
 * `RbacDecisionReason` envelope until a separate breaking release.
 */
type RbacLegacyDecisionReason = 'denied_resource_missing' | 'denied_role_expired' | 'denied_resource_mismatch';
/**
 * Compatibility reason union. Prefer `RbacServiceDecisionReason` when consuming
 * results returned by `RbacService.can()`.
 */
type RbacDecisionReason = RbacServiceDecisionReason | RbacLegacyDecisionReason;

type RbacParamResourceDeclaration = {
    type: string;
    idParam: string;
    idHeader?: never;
    idQuery?: never;
};
type RbacHeaderResourceDeclaration = {
    type: string;
    idHeader: string;
    idParam?: never;
    idQuery?: never;
};
type RbacQueryResourceDeclaration = {
    type: string;
    idQuery: string;
    idParam?: never;
    idHeader?: never;
};
type RbacBuiltInResourceDeclaration = RbacParamResourceDeclaration | RbacHeaderResourceDeclaration | RbacQueryResourceDeclaration;
interface RbacRequirementOptions {
    mode?: RbacRequirementMode | undefined;
    tenant?: 'required' | 'optional' | 'none' | undefined;
    resource?: RbacBuiltInResourceDeclaration | RbacResourceResolverFn | RbacResourceResolverToken | RbacResourceResolverTokenRef | undefined;
    /**
     * @deprecated Stored in decorator metadata for compatibility but never read,
     * returned in a decision, or written to RBAC audit events. Use application-owned
     * metadata for human-readable policy labels.
     */
    reason?: string | undefined;
}
type RbacRequirement = {
    kind: 'permission';
    permissions: string[];
    mode: RbacRequirementMode;
    options: RbacRequirementOptions;
} | {
    kind: 'role';
    roleKey: string;
    options: RbacRequirementOptions;
};

/**
 * Resolves a subject for the HTTP-only `RbacGuard` pipeline in 0.2.x.
 * Receiving an `ExecutionContext` does not make the complete Guard transport-neutral.
 */
type RbacSubjectResolver = (context: ExecutionContext) => Promise<RbacSubject | undefined> | RbacSubject | undefined;
/** Resolves a trusted tenant for the HTTP-only `RbacGuard` pipeline in 0.2.x. */
type RbacTenantResolver = (context: ExecutionContext, options: RbacRequirementOptions, subject: RbacSubject) => Promise<string | null | undefined> | string | null | undefined;
/** Resolves a resource for the HTTP-only `RbacGuard` pipeline in 0.2.x. */
type RbacResourceResolverFn = (context: ExecutionContext) => Promise<RbacResourceRef | undefined> | RbacResourceRef | undefined;

export type { RbacServiceEvaluationStep as A, RbacTenantMode as B, RbacTenantResolver as C, RbacRequirementOptions as R, RbacBuiltInResourceDeclaration as a, RbacSubjectResolver as b, RbacCanBaseInput as c, RbacCanInput as d, RbacDecision as e, RbacDecisionDetails as f, RbacDecisionMatchDetails as g, RbacDecisionMissingDetails as h, RbacDecisionReason as i, RbacDecisionRequirementDetails as j, RbacEvaluationStep as k, RbacHeaderResourceDeclaration as l, RbacLegacyDecisionReason as m, RbacParamResourceDeclaration as n, RbacPermissionCanInput as o, RbacQueryResourceDeclaration as p, RbacRequirement as q, RbacRequirementMode as r, RbacResourceResolverFn as s, RbacRoleCanInput as t, RbacServiceDecision as u, RbacServiceDecisionDetails as v, RbacServiceDecisionMatchDetails as w, RbacServiceDecisionMissingDetails as x, RbacServiceDecisionReason as y, RbacServiceDecisionRequirementDetails as z };