/**
 * Yii2 RBAC audit (N3).
 *
 * Builds a permission graph by cross-referencing two surfaces:
 *
 *   1. DEFINITIONS — permissions/roles created in seed migrations or
 *      RBAC seeder commands. The Yii2 idiom is:
 *
 *        $auth = Yii::$app->authManager;
 *        $auth->createPermission('viewUser');     // permission def
 *        $auth->createRole('admin');              // role def
 *        $auth->add($p);                          // register
 *        $auth->addChild($admin, $p);             // attach to role
 *
 *   2. RUNTIME CHECKS — `Yii::$app->user->can('viewUser')` calls in
 *      controllers/views, plus `AccessControl` rules in behaviors().
 *
 * Cross-referencing the two surfaces produces:
 *
 *   - orphan_checks:   permissions checked at runtime but never defined.
 *                      Indicates dead code OR a typo.
 *   - unused_definitions: permissions defined but never checked. Indicates
 *                         dead seed code OR a missing access guard.
 *   - controllers_without_access_control: classes that look like Controllers
 *                                         (web, REST) without any access
 *                                         restriction (no AccessControl in
 *                                         behaviors(), no can() calls).
 *   - dynamic_creates: createPermission($var) calls — name is computed at
 *                      runtime, can't statically resolve. Surfaced
 *                      separately so callers can flag them as "review
 *                      manually".
 *
 * The tool deliberately avoids opinions about which finding category is
 * "correct" — the consumer (audit skill, CTO, code reviewer) decides
 * which orphans matter and which were intentional.
 */
export interface RbacDefinitionRef {
    name: string;
    kind: "permission" | "role";
    file: string;
    line: number;
}
export interface RbacCheckRef {
    name: string;
    /** "code" — Yii::$app->user->can(...)
     *  "access-control" — AccessControl behavior `permissions => […]` */
    source: "code" | "access-control";
    file: string;
    line: number;
}
export interface RbacControllerRef {
    class: string;
    file: string;
    /** Reason it was flagged. */
    reason: "no-behaviors" | "no-access-control-in-behaviors" | "no-can-calls";
}
export interface YiiRbacAudit {
    repo: string;
    /** Resolved (statically determinable) permission/role definitions. */
    definitions: RbacDefinitionRef[];
    /** Runtime can() calls + AccessControl rule references. */
    checks: RbacCheckRef[];
    /** Permissions checked at runtime but not in definitions. */
    orphan_checks: string[];
    /** Permissions defined but never checked. */
    unused_definitions: string[];
    /** Controller classes with no AccessControl behavior or can() calls. */
    controllers_without_access_control: RbacControllerRef[];
    /** Sites where the permission name was a variable / function call —
     *  unresolvable statically. Flagged so the auditor reviews manually. */
    dynamic_creates: Array<{
        file: string;
        line: number;
        snippet: string;
    }>;
    /** Aggregate counts. */
    summary: {
        total_permissions: number;
        total_roles: number;
        total_checks: number;
        orphan_check_count: number;
        unused_definition_count: number;
        unsafe_controller_count: number;
    };
}
export declare function analyzeYiiRbac(repo: string, options?: {
    include_vendor?: boolean;
}): Promise<YiiRbacAudit>;
//# sourceMappingURL=yii-rbac-tools.d.ts.map