import { a as RbacSubject, R as RbacResourceRef } from './subject-DTDyIu82.cjs';

interface RbacRoleBinding {
    id: string;
    tenantId?: string | null;
    subjectType: string;
    subjectId: string;
    roleId: string;
    resourceType?: string | null;
    resourceId?: string | null;
    expiresAt?: Date | null;
    revokedAt?: Date | null;
    metadata?: Record<string, unknown>;
}
interface AssignRoleBaseInput {
    tenantId?: string | null | undefined;
    subject: RbacSubject;
    resource?: RbacResourceRef | undefined;
    expiresAt?: Date | null | undefined;
    metadata?: Record<string, unknown> | undefined;
}
type AssignRoleInput = AssignRoleBaseInput & ({
    roleId: string;
    roleKey?: never;
} | {
    roleKey: string;
    roleId?: never;
});
interface AssignRoleStorageInput extends AssignRoleBaseInput {
    roleId: string;
}
interface RevokeRoleInput {
    bindingId: string;
    revokedAt?: Date | undefined;
}
type RevokeRoleStorageInput = RevokeRoleInput;
interface ListBindingsInput {
    tenantId?: string | null | undefined;
    subject: RbacSubject;
}
type ListBindingsStorageInput = ListBindingsInput;

interface GrantPermissionInput {
    roleId: string;
    permission: string;
}
interface RevokePermissionInput {
    roleId: string;
    permission: string;
}
interface ListPermissionsInput {
    roleId: string;
}
interface ListRolePermissionsInput {
    roleId: string;
}

interface RbacRole {
    id: string;
    key: string;
    name?: string;
    description?: string;
    tenantId?: string | null;
    isSystem?: boolean;
    permissions: string[];
}
interface CreateRoleInput {
    tenantId?: string | null | undefined;
    key: string;
    name?: string | undefined;
    description?: string | undefined;
    isSystem?: boolean | undefined;
    permissions: string[];
}
interface UpdateRoleInput {
    roleId: string;
    tenantId?: string | null | undefined;
    key?: string | undefined;
    name?: string | undefined;
    description?: string | undefined;
    isSystem?: boolean | undefined;
    permissions?: string[] | undefined;
}
interface DeleteRoleInput {
    roleId: string;
}
interface ListRolesInput {
    tenantId?: string | null | undefined;
}
interface FindRoleInput {
    tenantId?: string | null | undefined;
    key: string;
}
interface FindRoleByIdInput {
    roleId: string;
}
type UpsertRoleInput = CreateRoleInput | UpdateRoleInput;

interface ListEffectiveRolesInput {
    subject: RbacSubject;
    tenantId?: string | null | undefined;
    resource?: RbacResourceRef | undefined;
    now?: Date | undefined;
}
type ListEffectivePermissionsInput = ListEffectiveRolesInput;
interface RbacEffectiveRole {
    roleKey: string;
    roleId: string;
    bindingId: string;
    /** `null` and `undefined` both identify a global effective record. */
    tenantId?: string | null | undefined;
    /** Resource scope is either an absent pair or two populated strings. */
    resourceType?: string | null;
    resourceId?: string | null;
    /** The record remains active when `expiresAt` is exactly equal to the query `now`. */
    expiresAt?: Date | null;
}
interface RbacEffectivePermission extends RbacEffectiveRole {
    permission: string;
}
type RbacMutationOutcome = 'created' | 'updated' | 'deleted' | 'no-op' | 'conflict';
type RbacMutationConflictReason = 'role_not_found' | 'duplicate';
interface RbacMutationResult<T = undefined> {
    outcome: RbacMutationOutcome;
    value?: T | undefined;
    reason?: RbacMutationConflictReason | undefined;
}
/**
 * Optional mutation-result protocol used to distinguish committed changes from
 * idempotent no-ops without changing the legacy RbacStorage method signatures.
 */
interface RbacStorageMutationCapability {
    createRole(input: CreateRoleInput): Promise<RbacMutationResult<RbacRole>>;
    updateRole(input: UpdateRoleInput): Promise<RbacMutationResult<RbacRole>>;
    deleteRole(input: DeleteRoleInput): Promise<RbacMutationResult>;
    grantPermission(input: GrantPermissionInput): Promise<RbacMutationResult>;
    revokePermission(input: RevokePermissionInput): Promise<RbacMutationResult>;
    assignRole(input: AssignRoleStorageInput): Promise<RbacMutationResult<RbacRoleBinding>>;
    revokeRole(input: RevokeRoleStorageInput): Promise<RbacMutationResult>;
}
/**
 * Additive 0.2.x capability for indexed role-id lookups. Implement this on
 * custom adapters before the legacy full-list fallback is removed in 0.3 or later.
 */
interface RbacStorageRoleLookupCapability {
    findRoleById(input: FindRoleByIdInput): Promise<RbacRole | null>;
}
interface RbacStorage {
    /**
     * Additive 0.2.x capability for outcome-aware writes. Custom adapters that
     * omit it use the deprecated result-less best-effort event fallback.
     */
    readonly mutationResults?: RbacStorageMutationCapability | undefined;
    /**
     * Optional indexed lookup used by strict assignment validation. Adapters that
     * omit it retain the deprecated 0.2.x `listRoles({})` compatibility fallback.
     */
    readonly findRoleById?: RbacStorageRoleLookupCapability['findRoleById'] | undefined;
    findRole(input: FindRoleInput): Promise<RbacRole | null>;
    listRoles(input: ListRolesInput): Promise<RbacRole[]>;
    upsertRole(input: UpsertRoleInput): Promise<RbacRole>;
    deleteRole(input: DeleteRoleInput): Promise<void>;
    grantPermission(input: GrantPermissionInput): Promise<void>;
    revokePermission(input: RevokePermissionInput): Promise<void>;
    listRolePermissions(input: ListRolePermissionsInput): Promise<string[]>;
    assignRole(input: AssignRoleStorageInput): Promise<RbacRoleBinding>;
    revokeRole(input: RevokeRoleStorageInput): Promise<void>;
    listBindings(input: ListBindingsStorageInput): Promise<RbacRoleBinding[]>;
    listEffectiveRoles(input: ListEffectiveRolesInput): Promise<RbacEffectiveRole[]>;
    listEffectivePermissions(input: ListEffectivePermissionsInput): Promise<RbacEffectivePermission[]>;
}

export type { AssignRoleBaseInput as A, CreateRoleInput as C, DeleteRoleInput as D, FindRoleByIdInput as F, GrantPermissionInput as G, ListBindingsInput as L, RbacEffectivePermission as R, UpdateRoleInput as U, AssignRoleInput as a, AssignRoleStorageInput as b, FindRoleInput as c, ListBindingsStorageInput as d, ListEffectivePermissionsInput as e, ListEffectiveRolesInput as f, ListPermissionsInput as g, ListRolePermissionsInput as h, ListRolesInput as i, RbacEffectiveRole as j, RbacMutationConflictReason as k, RbacMutationOutcome as l, RbacMutationResult as m, RbacRole as n, RbacRoleBinding as o, RbacStorage as p, RbacStorageMutationCapability as q, RbacStorageRoleLookupCapability as r, RevokePermissionInput as s, RevokeRoleInput as t, RevokeRoleStorageInput as u, UpsertRoleInput as v };