/**
 * Workspace-scoped RBAC for multi-tenant team-tier substrate.
 *
 * Six canonical workspace roles map to discrete permission sets.
 * These roles are workspace-scoped and distinct from the org-level
 * Role enum in packages/auth/src/rbac.ts (ORG_ADMIN, ORG_VIEWER, etc.).
 *
 * New permissions added here that did not exist in packages/auth/src/rbac.ts:
 *   WORKSPACE_ADMIN, POLICY_WRITE, POLICY_READ, REVIEW_APPROVE,
 *   REVIEW_DECLINE, BILLING_READ, BILLING_WRITE, MEMBER_INVITE,
 *   MEMBER_SUSPEND.
 *
 * Design rule: Owner has every permission. All other roles are additive
 * subsets -- never full-inherit to avoid privilege creep.
 *
 * @connexum/ai-governance tenant substrate
 */
import type { WorkspaceRole, WorkspaceMember } from './workspace';
export declare enum WorkspacePermission {
    WORKSPACE_ADMIN = "workspace:admin",
    POLICY_WRITE = "policy:write",
    POLICY_READ = "policy:read",
    REVIEW_APPROVE = "review:approve",
    REVIEW_DECLINE = "review:decline",
    BILLING_READ = "billing:read",
    BILLING_WRITE = "billing:write",
    MEMBER_INVITE = "member:invite",
    MEMBER_SUSPEND = "member:suspend",
    AGENT_READ = "agent:read",
    SCAN_RUN = "scan:run",
    AUDIT_READ = "audit:read",
    PACK_READ = "pack:read"
}
/**
 * Strictest-wins policy still applies here: a workspace-scoped role
 * CANNOT grant permissions the org-level role forbids. Enforcement
 * of org-level caps is done at the route layer (decodeClaims + this map).
 */
export declare const WORKSPACE_ROLE_PERMISSIONS: Record<WorkspaceRole, WorkspacePermission[]>;
export declare function hasWorkspacePermission(role: WorkspaceRole, permission: WorkspacePermission): boolean;
export interface WorkspaceAuthClaims {
    userId: string;
    workspaceId: string;
    role: WorkspaceRole;
}
/**
 * Look up the caller's membership in the workspace and verify they hold
 * at least the required role. Returns the claims or throws with a 403 message.
 *
 * Usage at route layer:
 *   const claims = requireRole(memberStore, workspaceId, userId, 'owner');
 *
 * Throws WorkspaceAuthError on access denied.
 */
export declare function requireRole(member: WorkspaceMember | null, requiredRole: WorkspaceRole): WorkspaceAuthClaims;
/**
 * Check that the caller's workspace role includes the specified permission.
 * Throws WorkspaceAuthError (403) if not.
 */
export declare function requirePermission(member: WorkspaceMember | null, permission: WorkspacePermission): WorkspaceAuthClaims;
export declare class WorkspaceAuthError extends Error {
    readonly statusCode: number;
    constructor(message: string, statusCode?: 403 | 401);
}
//# sourceMappingURL=rbac.d.ts.map