/**
 * Role model for the Users / access-control subsystem.
 *
 * The database enum (`UserRole`) carries six values for backward compatibility:
 * the four product-facing roles `OWNER`, `ADMIN`, `EDITOR`, `VIEWER` plus the
 * two legacy values `AUTHOR` and `CLIENT` that predate this subsystem. The admin
 * UI only ever speaks in the four product roles, so this module is the single
 * source of truth for:
 *
 *   - mapping any stored role to a product-facing display label,
 *   - mapping a display-label filter back to the enum values it covers,
 *   - which roles may be *assigned* to new/updated users,
 *   - a privilege rank used by protection checks (last-owner, self-demotion),
 *   - the permission groups each role grants.
 *
 * Everything here is pure and dependency-free so it can be unit-tested in
 * isolation and imported from the lightweight `@actuate-media/cms-core/roles`
 * subpath without pulling the full barrel.
 */
export type UserRoleEnum = 'OWNER' | 'ADMIN' | 'EDITOR' | 'AUTHOR' | 'CLIENT' | 'VIEWER';
export type DisplayRole = 'Owner' | 'Admin' | 'Editor' | 'Viewer';
/** Roles offered in the invite modal and role dropdowns, in privilege order. */
export declare const ASSIGNABLE_ROLES: readonly UserRoleEnum[];
/** All product-facing display roles, used for the filter pills. */
export declare const DISPLAY_ROLES: readonly DisplayRole[];
/**
 * Privilege rank — higher is more privileged. Used to enforce "you cannot act on
 * someone more privileged than you" and last-owner / self-demotion protections.
 * Legacy roles rank with their display equivalent.
 */
export declare const ROLE_RANK: Record<UserRoleEnum, number>;
/** Map any stored role (incl. legacy) to its product-facing display label. */
export declare function toDisplayRole(role: string | null | undefined): DisplayRole;
/** Validate + normalize a role coming from the UI for assignment. */
export declare function normalizeAssignableRole(role: string | null | undefined): UserRoleEnum | null;
/**
 * The enum values a display-role filter covers. Returns `null` for "all" or an
 * unrecognized label so callers can skip filtering.
 */
export declare function enumRolesForDisplay(display: string | null | undefined): UserRoleEnum[] | null;
export declare function isOwnerRole(role: string | null | undefined): boolean;
/** Rank of a role (0 for unknown). */
export declare function roleRank(role: string | null | undefined): number;
/** Every permission scope recognised by the system. */
export declare const ALL_PERMISSIONS: readonly ["dashboard.view", "content.view", "content.create", "content.update", "content.publish", "content.delete", "pages.manage", "posts.manage", "media.manage", "forms.manage", "seo.manage", "redirects.manage", "scripts.manage", "users.view", "users.invite", "users.update", "users.update_role", "users.remove", "users.suspend", "users.reset_password", "users.reset_mfa", "sessions.view", "sessions.revoke", "api_keys.manage", "settings.manage", "security.manage", "audit.view", "billing.manage", "workspace.delete", "workspace.owner_actions"];
export type Permission = (typeof ALL_PERMISSIONS)[number];
/** Effective permissions granted by a role. */
export declare function permissionsForRole(role: string | null | undefined): Permission[];
/** Whether a role grants a specific permission. */
export declare function roleHasPermission(role: string | null | undefined, permission: Permission): boolean;
//# sourceMappingURL=roles.d.ts.map