// schemas/rbac.ts — Zod input schemas for RBAC tools (SPEC-166)
import { z } from 'zod';
export const RbacRoleEnum = z
    .enum(['Admin', 'Architect', 'Developer', 'Reviewer', 'Observer'])
    .describe('RBAC role: Admin (full access) | Architect (create/approve/configure) | Developer (read/update/implement) | Reviewer (read/approve) | Observer (read-only)');
export const ConfigureRolesInputSchema = z.object({
    projectId: z.string().min(1).describe('Project identifier (hash of the project path).'),
    enabled: z
        .boolean()
        .describe('Enable (true) or disable (false) RBAC for this project. When disabled, all operations are allowed (single-user mode).'),
});
export const AssignRoleInputSchema = z.object({
    projectId: z.string().min(1).describe('Project identifier (hash of the project path).'),
    userId: z.string().min(1).describe('User identifier — typically email or OAuth subject claim.'),
    role: RbacRoleEnum,
    specId: z
        .string()
        .optional()
        .describe('Optional. When set, this assignment is scoped to a specific spec and overrides the project-level role.'),
    assignedBy: z
        .string()
        .optional()
        .describe('Optional. User ID of the admin performing the assignment.'),
});
//# sourceMappingURL=rbac.js.map