import type { Container } from '../../../../helpers/inversion/container';
import type { TClass } from '@venizia/ignis-helpers/common';
import type { IAuthUser } from '../../authenticate/common/types';
import { AbstractAuthRegistry } from '../../base';
import type { AuthorizationEnforcerTypes, IAuthorizationEnforcer, IAuthorizationUser, IAuthorizeOptions, ICasbinEnforcerOptions } from '../common';
export declare class AuthorizationEnforcerRegistry extends AbstractAuthRegistry<IAuthorizationEnforcer> {
    static readonly SINGLETON_REAL_KEY = "authorization-enforcer-registry";
    private configuredEnforcers;
    /** In-flight `configure()` calls, so concurrent first requests share one warmup instead of racing. */
    private pendingConfigurations;
    /** Set by AuthorizeComponent from the application container. Held here because the descriptor scan
     * below sees only registered enforcers, and `defaultDecision` has to be readable when there are none. */
    private applicationOptions;
    constructor();
    static getInstance(): AuthorizationEnforcerRegistry;
    reset(): void;
    protected getBindingPrefix(): string;
    register(opts: {
        container: Container;
        enforcers: Array<{
            enforcer: TClass<IAuthorizationEnforcer>;
            name: string;
            type: typeof AuthorizationEnforcerTypes.CASBIN;
            options?: ICasbinEnforcerOptions;
        } | {
            enforcer: TClass<IAuthorizationEnforcer>;
            name: string;
            type: typeof AuthorizationEnforcerTypes.CUSTOM;
            options?: unknown;
        }>;
    }): this;
    hasEnforcers(): boolean;
    getDefaultEnforcerName(): string;
    /**
     * The PROMISE is memoised, not just the completed flag.
     *
     * `configure()` yields (it dynamic-imports casbin), and the flag was only set after the await -
     * so a burst of first requests each saw an unconfigured enforcer and each built a full pool.
     * Measured: 40 concurrent first requests produced 40 configure() calls and 640 enforcers.
     * The entry is dropped on rejection so a failed warmup does not poison every later request.
     */
    resolveEnforcer(opts: {
        name: string;
    }): Promise<IAuthorizationEnforcer>;
    /** Drop a user's cached policies on the resolved enforcer. Lazy - next request rebuilds. */
    invalidateUserCache(opts: {
        user: IAuthorizationUser;
        enforcerName?: string;
    }): Promise<{
        invalidatedKeys: number;
    }>;
    /** Drop then immediately rebuild + re-cache a user's policies on the resolved enforcer. */
    rebuildUserCache(opts: {
        user: {
            principalType: string;
        } & IAuthUser;
        enforcerName?: string;
    }): Promise<{
        cacheKey: string;
        lineCount: number;
    }>;
    /** Options bound on the application, independent of any enforcer. */
    setOptions(opts: {
        options: IAuthorizeOptions;
    }): void;
    resolveOptions(): IAuthorizeOptions | undefined;
}
//# sourceMappingURL=enforcer-registry.d.ts.map