import type { UserModel as OrmUserModel } from '@stacksjs/orm';
/**
 * Set the RBAC store implementation
 */
export declare function setRbacStore(rbacStore: RbacStore): void;
/**
 * Flush the RBAC cache
 */
export declare function flushRbacCache(): void;
/**
 * Create a new role
 */
export declare function createRole(name: string, guardName?: string, description?: string): Promise<RoleRecord>;
/**
 * Find a role by name
 */
export declare function findRole(name: string, guardName?: string): Promise<RoleRecord | null>;
/**
 * Delete a role
 */
export declare function deleteRole(name: string, guardName?: string): Promise<void>;
/**
 * Get all roles
 */
export declare function getAllRoles(guardName?: string): Promise<RoleRecord[]>;
/**
 * Create a new permission
 */
export declare function createPermission(name: string, guardName?: string, description?: string): Promise<PermissionRecord>;
/**
 * Find a permission by name
 */
export declare function findPermission(name: string, guardName?: string): Promise<PermissionRecord | null>;
/**
 * Delete a permission
 */
export declare function deletePermission(name: string, guardName?: string): Promise<void>;
/**
 * Get all permissions
 */
export declare function getAllPermissions(guardName?: string): Promise<PermissionRecord[]>;
/**
 * Get all roles for a user
 */
export declare function getUserRoles(user: UserModel | { id: number } | number): Promise<RoleRecord[]>;
/**
 * Assign a role to a user
 */
export declare function assignRole(user: UserModel | { id: number } | number, roleName: string, guardName?: string): Promise<void>;
/**
 * Remove a role from a user
 */
export declare function removeRole(user: UserModel | { id: number } | number, roleName: string, guardName?: string): Promise<void>;
/**
 * Remove all roles from a user
 */
export declare function removeAllRoles(user: UserModel | { id: number } | number): Promise<void>;
/**
 * Sync roles for a user within one guard.
 *
 * Roles belonging to other guards are preserved. The previous implementation
 * resolved the requested names within `guardName`, then replaced the complete
 * pivot set, which silently removed assignments from every other guard.
 */
export declare function syncRoles(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<void>;
/**
 * Check if a user has a specific role
 */
export declare function hasRole(user: UserModel | { id: number } | number, roleName: string, guardName?: string): Promise<boolean>;
/**
 * Check if a user has any of the given roles
 */
export declare function hasAnyRole(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<boolean>;
/**
 * Check if a user has all of the given roles
 */
export declare function hasAllRoles(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<boolean>;
/**
 * Get all permissions for a user (direct + via roles)
 */
export declare function getUserPermissions(user: UserModel | { id: number } | number): Promise<PermissionRecord[]>;
/**
 * Give a direct permission to a user
 */
export declare function givePermission(user: UserModel | { id: number } | number, permissionName: string, guardName?: string): Promise<void>;
/**
 * Revoke a direct permission from a user
 */
export declare function revokePermission(user: UserModel | { id: number } | number, permissionName: string, guardName?: string): Promise<void>;
/**
 * Revoke all direct permissions from a user
 */
export declare function revokeAllPermissions(user: UserModel | { id: number } | number): Promise<void>;
/**
 * Sync direct permissions for a user within one guard.
 *
 * Direct permissions belonging to other guards are preserved.
 */
export declare function syncPermissions(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<void>;
/**
 * Check if a user has a specific permission (direct or via role)
 */
export declare function hasPermission(user: UserModel | { id: number } | number, permissionName: string, guardName?: string): Promise<boolean>;
/**
 * Check if a user has any of the given permissions
 */
export declare function hasAnyPermission(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<boolean>;
/**
 * Check if a user has all of the given permissions
 */
export declare function hasAllPermissions(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<boolean>;
/**
 * Get all permissions for a role
 */
export declare function getRolePermissions(roleId: number): Promise<PermissionRecord[]>;
/**
 * Assign a permission to a role
 */
export declare function givePermissionToRole(roleName: string, permissionName: string, guardName?: string): Promise<void>;
/**
 * Remove a permission from a role
 */
export declare function revokePermissionFromRole(roleName: string, permissionName: string, guardName?: string): Promise<void>;
/**
 * Sync permissions for a role
 */
export declare function syncRolePermissions(roleName: string, permissionNames: string[], guardName?: string): Promise<void>;
/**
 * Add RBAC methods to a user object
 *
 * @example
 * const user = withRbac(authenticatedUser)
 * if (await user.hasRole('admin')) { ... }
 * await user.assignRole('editor')
 */
export declare function withRbac<T extends UserModel | { id: number }>(user: T): T & RbacMethods;
/**
 * RBAC facade for convenient access
 */
export declare const Rbac: {
  setStore: unknown;
  flushCache: unknown;
  createRole: typeof createRole;
  findRole: typeof findRole;
  deleteRole: typeof deleteRole;
  getAllRoles: typeof getAllRoles;
  createPermission: typeof createPermission;
  findPermission: typeof findPermission;
  deletePermission: typeof deletePermission;
  getAllPermissions: typeof getAllPermissions;
  getUserRoles: typeof getUserRoles;
  assignRole: typeof assignRole;
  removeRole: typeof removeRole;
  removeAllRoles: typeof removeAllRoles;
  syncRoles: typeof syncRoles;
  hasRole: typeof hasRole;
  hasAnyRole: typeof hasAnyRole;
  hasAllRoles: typeof hasAllRoles;
  getUserPermissions: typeof getUserPermissions;
  givePermission: typeof givePermission;
  revokePermission: typeof revokePermission;
  revokeAllPermissions: typeof revokeAllPermissions;
  syncPermissions: typeof syncPermissions;
  hasPermission: typeof hasPermission;
  hasAnyPermission: typeof hasAnyPermission;
  hasAllPermissions: typeof hasAllPermissions;
  getRolePermissions: typeof getRolePermissions;
  givePermissionToRole: typeof givePermissionToRole;
  revokePermissionFromRole: typeof revokePermissionFromRole;
  syncRolePermissions: typeof syncRolePermissions;
  withRbac: typeof withRbac
};
export declare interface RoleRecord {
  id: number
  name: string
  guard_name: string
  description?: string
  created_at?: string
  updated_at?: string
}
export declare interface PermissionRecord {
  id: number
  name: string
  guard_name: string
  description?: string
  created_at?: string
  updated_at?: string
}
export declare interface RolePermissionPivot {
  role_id: number
  permission_id: number
  created_at?: string
}
export declare interface UserRolePivot {
  user_id: number
  role_id: number
  created_at?: string
}
export declare interface UserPermissionPivot {
  user_id: number
  permission_id: number
  created_at?: string
}
/**
 * RBAC database adapter interface.
 * Implement this to connect RBAC to your database layer.
 */
export declare interface RbacStore {
  findRoleByName(name: string, guardName?: string): Promise<RoleRecord | null>
  findRoleById(id: number): Promise<RoleRecord | null>
  createRole(name: string, guardName?: string, description?: string): Promise<RoleRecord>
  deleteRole(id: number): Promise<void>
  getAllRoles(guardName?: string): Promise<RoleRecord[]>
  findPermissionByName(name: string, guardName?: string): Promise<PermissionRecord | null>
  findPermissionById(id: number): Promise<PermissionRecord | null>
  createPermission(name: string, guardName?: string, description?: string): Promise<PermissionRecord>
  deletePermission(id: number): Promise<void>
  getAllPermissions(guardName?: string): Promise<PermissionRecord[]>
  getUserRoles(userId: number): Promise<RoleRecord[]>
  assignRoleToUser(userId: number, roleId: number): Promise<void>
  removeRoleFromUser(userId: number, roleId: number): Promise<void>
  removeAllRolesFromUser(userId: number): Promise<void>
  syncUserRoles(userId: number, roleIds: number[]): Promise<void>
  getUserDirectPermissions(userId: number): Promise<PermissionRecord[]>
  assignPermissionToUser(userId: number, permissionId: number): Promise<void>
  removePermissionFromUser(userId: number, permissionId: number): Promise<void>
  removeAllPermissionsFromUser(userId: number): Promise<void>
  syncUserPermissions(userId: number, permissionIds: number[]): Promise<void>
  getRolePermissions(roleId: number): Promise<PermissionRecord[]>
  assignPermissionToRole(roleId: number, permissionId: number): Promise<void>
  removePermissionFromRole(roleId: number, permissionId: number): Promise<void>
  syncRolePermissions(roleId: number, permissionIds: number[]): Promise<void>
}
// ─── Authorizable Mixin (add to user objects) ───────────────────
export declare interface RbacMethods {
  hasRole(roleName: string, guardName?: string): Promise<boolean>
  hasAnyRole(roleNames: string[], guardName?: string): Promise<boolean>
  hasAllRoles(roleNames: string[], guardName?: string): Promise<boolean>
  hasPermission(permissionName: string, guardName?: string): Promise<boolean>
  hasAnyPermission(permissionNames: string[], guardName?: string): Promise<boolean>
  hasAllPermissions(permissionNames: string[], guardName?: string): Promise<boolean>
  getRoles(): Promise<RoleRecord[]>
  getPermissions(): Promise<PermissionRecord[]>
  assignRole(roleName: string, guardName?: string): Promise<void>
  removeRole(roleName: string, guardName?: string): Promise<void>
  syncRoles(roleNames: string[], guardName?: string): Promise<void>
  givePermission(permissionName: string, guardName?: string): Promise<void>
  revokePermission(permissionName: string, guardName?: string): Promise<void>
  syncPermissions(permissionNames: string[], guardName?: string): Promise<void>
}
// Use the row/instance shape from orm so role helpers operate on the
// authenticated user object, not the User class constructor.
declare type UserModel = OrmUserModel;
export type RbacEntity = 'permission' | 'role';
export declare class RbacEntityNotFoundError extends Error {
  public readonly entity: RbacEntity;
  public readonly value: string;
  public readonly guardName: string;
  constructor(entity: RbacEntity, value: string, guardName: string);
}
/**
 * FIFO-bounded Map. Wraps Map with a hard size cap; on overflow, the
 * oldest entry (Map insertion order) is evicted. Used for the RBAC
 * per-user caches because the previous unbounded `Map<number, ...>`
 * grew without limit across the process lifetime — a long-running
 * server serving many distinct users would OOM eventually
 * (stacksjs/stacks#1860 M-5). Same shape as `BoundedMap` in
 * `@stacksjs/router/stacks-router.ts`.
 */
declare class BoundedMap<K, V> {
  constructor(max: number);
  get(key: K): V | undefined;
  has(key: K): boolean;
  set(key: K, value: V): this;
  delete(key: K): boolean;
  clear(): void;
}
export default Rbac;