/**
 * PermissionResolver — Focused responsibility: role and scope checks.
 *
 * Inspects a `ControlPlaneAuthSnapshot` to answer permission questions.
 * Callers that only need access control checks can use this directly
 * rather than traversing the full auth snapshot themselves.
 */
export class PermissionResolver {
    #snapshot;
    constructor(snapshot) {
        this.#snapshot = snapshot;
    }
    /** Whether the current principal is authenticated. */
    get authenticated() {
        return this.#snapshot.authenticated;
    }
    /** Whether the current principal has admin privileges. */
    get isAdmin() {
        return this.#snapshot.admin;
    }
    /** The principal identifier (user/bot/service id), or null when anonymous. */
    get principalId() {
        return this.#snapshot.principalId;
    }
    /** The kind of the current principal. */
    get principalKind() {
        return this.#snapshot.principalKind;
    }
    /** Return true when the principal holds the given role. */
    hasRole(role) {
        return this.#snapshot.roles.includes(role);
    }
    /** Return true when the principal holds ALL of the given roles. */
    hasAllRoles(roles) {
        return roles.every((role) => this.#snapshot.roles.includes(role));
    }
    /** Return true when the principal holds ANY of the given roles. */
    hasAnyRole(roles) {
        return roles.some((role) => this.#snapshot.roles.includes(role));
    }
    /** Return true when the principal holds the given scope. */
    hasScope(scope) {
        return this.#snapshot.scopes.includes(scope);
    }
    /** Return true when the principal holds ALL of the given scopes. */
    hasAllScopes(scopes) {
        return scopes.every((scope) => this.#snapshot.scopes.includes(scope));
    }
    /** Return true when the principal holds ANY of the given scopes. */
    hasAnyScope(scopes) {
        return scopes.some((scope) => this.#snapshot.scopes.includes(scope));
    }
    /** Expose the raw snapshot for direct inspection. */
    get snapshot() {
        return this.#snapshot;
    }
}
