import { z } from 'zod';
import { UserRole } from './auth.schema.js';
export type AppAction = 'manage' | 'read' | 'create' | 'update' | 'delete' | 'execute';
/**
 * Domain subjects - entity-level access with instance conditions
 * - Operator: condition { id: string }
 * - Transmission: condition { operatorId: string }
 * - Token / AuthConfig: admin-only management
 */
export type DomainSubject = 'Operator' | 'Transmission' | 'Token' | 'AuthConfig';
/**
 * Capability subjects - delegatable atomic permissions
 * Each Permission enum value maps to exactly one CapabilitySubject
 */
export type CapabilitySubject = 'RadioFrequency' | 'RadioTuner' | 'RadioTune' | 'RadioConfig' | 'RadioReconnect' | 'RadioControl' | 'RadioPower' | 'RigctldBridge' | 'Engine' | 'ModeSwitch' | 'CWDecoder' | 'CWDecoderConfig' | 'SettingsDecodeWindows' | 'SettingsFrequencyPresets' | 'StationInfo';
export type AppSubject = DomainSubject | CapabilitySubject | 'all';
/** CASL generic type parameter: [Action, Subject] */
export type AppAbilities = [AppAction, AppSubject];
export declare enum Permission {
    RADIO_SET_FREQUENCY = "radio:set_frequency",
    RADIO_SET_TUNER = "radio:set_tuner",
    RADIO_TUNE = "radio:tune",
    RADIO_CONFIG = "radio:config",
    RADIO_RECONNECT = "radio:reconnect",
    /** 统一电台控制能力写命令（AF增益、静噪、发射功率等）*/
    RADIO_CONTROL = "radio:control",
    /** 电台电源管理（开机/关机）— 独立于 RADIO_CONTROL，影响物理设备可达性 */
    RADIO_POWER = "radio:power",
    /** 启停 rigctld TCP 桥接（允许外部软件如 N1MM / WSJT-X 接入当前电台）*/
    RIGCTLD_BRIDGE = "rigctld:bridge",
    ENGINE_START_STOP = "engine:start_stop",
    MODE_SWITCH = "mode:switch",
    CW_DECODER_CONTROL = "cw:decoder_control",
    CW_DECODER_CONFIG = "cw:decoder_config",
    SETTINGS_DECODE_WINDOWS = "settings:decode_windows",
    SETTINGS_FREQUENCY_PRESETS = "settings:frequency_presets",
    STATION_UPDATE = "station:update"
}
export declare const PermissionSchema: z.ZodNativeEnum<typeof Permission>;
export declare const PERMISSION_RULE_MAP: Record<Permission, {
    action: AppAction;
    subject: CapabilitySubject;
}>;
export declare const PermissionGrantSchema: z.ZodObject<{
    permission: z.ZodNativeEnum<typeof Permission>;
    /** MongoDB-style conditions for CASL, e.g. { frequency: { $in: [14074000] } } */
    conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    permission: Permission;
    conditions?: Record<string, unknown> | undefined;
}, {
    permission: Permission;
    conditions?: Record<string, unknown> | undefined;
}>;
export type PermissionGrant = z.infer<typeof PermissionGrantSchema>;
export interface FrequencyPermissionRange {
    band?: string;
    minFrequency: number;
    maxFrequency: number;
}
export declare const FREQUENCY_PERMISSION_BAND_RANGES: Record<string, FrequencyPermissionRange>;
export declare function getPresetFrequenciesFromFrequencyGrants(grants: PermissionGrant[] | undefined): number[];
export declare function getRangesFromFrequencyGrants(grants: PermissionGrant[] | undefined): FrequencyPermissionRange[];
export declare function inferFrequencyPermissionBand(minFrequency: number, maxFrequency: number): string | undefined;
export declare function buildRadioFrequencyPermissionGrants(presetFrequencies: number[], ranges: FrequencyPermissionRange[]): PermissionGrant[];
export interface RawRule {
    action: AppAction | AppAction[];
    subject: AppSubject | AppSubject[];
    conditions?: Record<string, unknown>;
    inverted?: boolean;
}
/**
 * Build CASL-compatible rules from role + operatorIds + permission grants.
 * Three layers stacked:
 *   Layer 1: Role-based defaults
 *   Layer 2: Operator data scope (operatorIds → conditions)
 *   Layer 3: Custom permission grants
 *
 * Returns pure JSON — server/web each call createMongoAbility() with these rules.
 */
export declare function buildAbilityRules(params: {
    role: UserRole;
    operatorIds?: string[];
    permissionGrants?: PermissionGrant[];
}): RawRule[];
export interface PermissionGroupDef {
    key: string;
    permissions: Permission[];
}
export declare const PERMISSION_GROUPS: PermissionGroupDef[];
/** Permissions that support condition constraints (UI shows condition editor) */
export declare const CONDITIONAL_PERMISSIONS: Partial<Record<Permission, {
    conditionField: string;
    conditionOperator: '$in';
    labelKey: string;
}>>;
//# sourceMappingURL=ability.d.ts.map