"""RBAC v2 authorization package (see docs/plans/rbac-system-wide-submenu-implementation-plan.md).

Public interface — callers must not query role slugs or permission tables directly:

    effective_capabilities(user, organization) -> frozenset[str]
    has_capability(user, organization, code) -> bool
    entitlements(user, organization) -> list[Entitlement]

DRF views declare a method-aware ``capability_map`` and use ``RequiresCapabilities``.
"""

from .registry import (  # noqa: F401
    CapabilityDefinition,
    all_capabilities,
    baseline_capability_codes,
    capabilities_for_module,
    get_capability,
    is_registered,
)
from .resolver import (  # noqa: F401
    Entitlement,
    effective_capabilities,
    entitlements,
    has_capability,
)
from .drf import (  # noqa: F401
    AUTHENTICATED_PERSONAL,
    DENY,
    PUBLIC,
    RequiresCapabilities,
)