import type { AccessFn, RbacConfig } from "./types.js";
/**
 * Role-based access control. Resolves a session's roles to a flat permission set (expanding
 * inheritance + wildcards) and exposes helpers that slot directly into Nixxie
 * `access` functions.
 */
export declare class Rbac<Session = any> {
    private roles;
    private getRoles;
    constructor(config: RbacConfig<Session>);
    private rolesOf;
    /** Expand a role to the full set of permission strings it grants, following `inherits`. */
    private permissionsForRole;
    /** All permissions granted to a session across its roles. */
    permissions(session: Session | undefined): Set<string>;
    /** Whether the session holds a given role. */
    hasRole(session: Session | undefined, role: string): boolean;
    /** Whether the session is granted a permission, honouring `*` and `resource:*` wildcards. */
    can(session: Session | undefined, permission: string): boolean;
    /** Access function granting access when the session has the permission. */
    permission(permission: string): AccessFn<Session>;
    /** Access function granting access when the session has any of the permissions. */
    anyPermission(...permissions: string[]): AccessFn<Session>;
    /** Access function granting access when the session has every permission. */
    allPermissions(...permissions: string[]): AccessFn<Session>;
    /** Access function granting access when the session holds one of the roles. */
    requireRole(...roles: string[]): AccessFn<Session>;
}
export declare function createRbac<Session = any>(config: RbacConfig<Session>): Rbac<Session>;
export type { RbacConfig, RoleDefinition, AccessArgs, AccessFn } from "./types.js";
//# sourceMappingURL=index.d.ts.map