export type RoleDefinition = {
    /**
     * Permissions granted to this role. Supports exact strings (`'post:update'`),
     * resource wildcards (`'post:*'`) and the global wildcard (`'*'`).
     */
    permissions: string[];
    /** Other roles whose permissions are also granted (single-level or nested inheritance). */
    inherits?: string[];
};
export type RbacConfig<Session = any> = {
    /** Map of role name → definition. */
    roles: Record<string, RoleDefinition>;
    /**
     * Extract the role name(s) for a session. Defaults to `session.data.role ?? session.role`.
     * Return a string, an array of strings, or undefined for an unauthenticated request.
     */
    getRoles?: (session: Session | undefined) => string | string[] | undefined;
};
/** Shape of the argument Nixxie access-control functions receive. */
export type AccessArgs<Session = any> = {
    session?: Session;
};
export type AccessFn<Session = any> = (args: AccessArgs<Session>) => boolean;
//# sourceMappingURL=types.d.ts.map