import type { AccessCapability, AccessRole, AccessRoleDefinition, AccessSubject } from "../../types/index.js";
/**
 * Estrategia de verificación de acceso - Strategy Pattern.
 *
 * Define el contrato que toda implementación de control de acceso debe
 * cumplir. El {@link AccessService} delega en una estrategia concreta,
 * permitiendo intercambiar el algoritmo de autorización sin tocar al cliente.
 */
export interface IAccessStrategy {
    /** Effective capabilities of a role (own plus inherited). */
    useCapabilitiesFor(role: AccessRole): AccessCapability[];
    /** Registers (or replaces) a role definition. */
    useRegisterRole(definition: AccessRoleDefinition): void;
    /** Restores the built-in role registry. */
    useResetRoles(): void;
    /** Lists every registered role definition. */
    useRoles(): AccessRoleDefinition[];
    /** Exact role membership - no hierarchy involved. */
    useHasRole(subject: AccessSubject, role: AccessRole): boolean;
    /** Whether the subject may perform a capability. */
    useCan(subject: AccessSubject, capability: AccessCapability): boolean;
}
/**
 * Estrategia por defecto: control de acceso jerárquico basado en roles
 * registrados. Es la estrategia estándar del servicio.
 *
 * @example
 * ```ts
 * const strategy = new HierarchicalAccessStrategy();
 * strategy.useCan({ id: 1, roles: ["editor"] }, "content:create"); // true
 * ```
 */
export declare class HierarchicalAccessStrategy implements IAccessStrategy {
    /** Active registry, keyed by role slug. Starts as the default set. */
    private registry;
    constructor();
    private useDefinitionFor;
    /**
     * Effective capabilities of a role: its own plus every less-privileged role's.
     *
     * @example
     * ```ts
     * useCapabilitiesFor("author"); // content:create, content:edit:own, ..., conversations:use
     * useCapabilitiesFor("guest");  // []
     * ```
     */
    useCapabilitiesFor(role: AccessRole): AccessCapability[];
    /**
     * Registers (or replaces) a role definition. Use it to extend a built-in
     * role's capabilities, e.g. grant `content:create` to `member`. The definition
     * is copied, so mutating the caller's object afterwards has no effect.
     */
    useRegisterRole(definition: AccessRoleDefinition): void;
    /** Restores the built-in role registry (mainly for tests). */
    useResetRoles(): void;
    /** Lists every registered role definition. Returns copies, not live state. */
    useRoles(): AccessRoleDefinition[];
    /** Exact role membership - no hierarchy involved. */
    useHasRole(subject: AccessSubject, role: AccessRole): boolean;
    /**
     * Whether the subject may perform a capability. Any of the subject's roles
     * granting the capability (directly or by inheritance) is enough.
     *
     * @example
     * ```ts
     * useCan({ id: 1, roles: ["author"] }, "content:publish"); // false
     * useCan({ id: 1, roles: ["author"] }, "content:create");  // true
     * useCan({ id: 2, roles: ["editor"] }, "content:create");  // true (inherits author)
     * useCan({ id: 3, roles: [] }, "conversations:use");       // false
     * ```
     */
    useCan(subject: AccessSubject, capability: AccessCapability): boolean;
}
/**
 * Estrategia estricta: sólo verifica capacidades declaradas explícitamente
 * en el rol del sujeto, sin her jerarquía. Útil cuando cada rol debe
 * declarar todo lo que puede hacer.
 *
 * @example
 * ```ts
 * const access = new AccessService(new FlatAccessStrategy());
 * // "editor" ya NO hereda las capacidades de "author"
 * access.useCan({ id: 1, roles: ["editor"] }, "content:create"); // false
 * ```
 */
export declare class FlatAccessStrategy implements IAccessStrategy {
    private registry;
    constructor();
    useCapabilitiesFor(role: AccessRole): AccessCapability[];
    useRegisterRole(definition: AccessRoleDefinition): void;
    useResetRoles(): void;
    useRoles(): AccessRoleDefinition[];
    useHasRole(subject: AccessSubject, role: AccessRole): boolean;
    useCan(subject: AccessSubject, capability: AccessCapability): boolean;
}
/**
 * AccessService - Singleton facade con Strategy Pattern.
 *
 * Centraliza el control de acceso (roles y capacidades) delegando el
 * algoritmo concreto en una {@link IAccessStrategy} intercambiable.
 * Por defecto usa {@link HierarchicalAccessStrategy}.
 *
 * @example
 * ```ts
 * // Uso con la estrategia por defecto (jerárquica)
 * AccessService.getInstance().useCan({ id: 1, roles: ["admin"] }, "members:manage");
 *
 * // Cambiar a estrategia plana en runtime
 * AccessService.getInstance().useSetStrategy(new FlatAccessStrategy());
 * ```
 */
export declare class AccessService {
    private static instance;
    private strategy;
    /**
     * Constructor privado - enforce singleton.
     * @param strategy - Estrategia a inyectar (opcional).
     */
    private constructor();
    /**
     * Obtiene la instancia única del AccessService (Singleton).
     *
     * @returns La instancia única de {@link AccessService}.
     */
    static getInstance(): AccessService;
    /**
     * Crea una instancia NO-singleton con una estrategia específica.
     * Útil para tests o para aislar varios contextos de acceso.
     *
     * @param strategy - Estrategia a inyectar.
     * @returns Una nueva instancia de {@link AccessService}.
     *
     * @example
     * ```ts
     * const flatAccess = AccessService.create(new FlatAccessStrategy());
     * ```
     */
    static create(strategy?: IAccessStrategy): AccessService;
    /**
     * Intercambia la estrategia de acceso en runtime (Strategy Pattern).
     *
     * @param strategy - La nueva estrategia a utilizar.
     */
    useSetStrategy(strategy: IAccessStrategy): void;
    /** Returns the currently active strategy. */
    useGetStrategy(): IAccessStrategy;
    /**
     * Effective capabilities of a role (delegado a la estrategia activa).
     */
    useCapabilitiesFor(role: AccessRole): AccessCapability[];
    /**
     * Registers (or replaces) a role definition (delegado a la estrategia activa).
     */
    useRegisterRole(definition: AccessRoleDefinition): void;
    /** Restores the built-in role registry (delegado a la estrategia activa). */
    useResetRoles(): void;
    /** Lists every registered role definition (delegado a la estrategia activa). */
    useRoles(): AccessRoleDefinition[];
    /** Exact role membership - no hierarchy involved. */
    useHasRole(subject: AccessSubject, role: AccessRole): boolean;
    /**
     * Whether the subject may perform a capability (delegado a la estrategia activa).
     */
    useCan(subject: AccessSubject, capability: AccessCapability): boolean;
}
/**
 * Effective capabilities of a role: its own plus every less-privileged role's.
 *
 * @example
 * ```ts
 * useCapabilitiesFor("author"); // content:create, content:edit:own, ..., conversations:use
 * useCapabilitiesFor("guest");  // []
 * ```
 */
export declare function useCapabilitiesFor(role: AccessRole): AccessCapability[];
/**
 * Registers (or replaces) a role definition. Use it to extend a built-in
 * role's capabilities, e.g. grant `content:create` to `member`.
 */
export declare function useRegisterRole(definition: AccessRoleDefinition): void;
/** Restores the built-in role registry (mainly for tests). */
export declare function useResetRoles(): void;
/** Lists every registered role definition. Returns copies, not live state. */
export declare function useRoles(): AccessRoleDefinition[];
/** Exact role membership - no hierarchy involved. */
export declare function useHasRole(subject: AccessSubject, role: AccessRole): boolean;
/**
 * Whether the subject may perform a capability. Any of the subject's roles
 * granting the capability (directly or by inheritance) is enough.
 *
 * @example
 * ```ts
 * useCan({ id: 1, roles: ["author"] }, "content:publish"); // false
 * useCan({ id: 1, roles: ["author"] }, "content:create");  // true
 * useCan({ id: 2, roles: ["editor"] }, "content:create");  // true (inherits author)
 * useCan({ id: 3, roles: [] }, "conversations:use");       // false
 * ```
 */
export declare function useCan(subject: AccessSubject, capability: AccessCapability): boolean;
//# sourceMappingURL=access.service.d.ts.map