/** Box-wide role. `admin` owns the server and everything hosted on it. */
export type BoxRole = 'admin' | 'member';
/**
 * A member's role on one site. `owner` can additionally change that site's
 * settings; `collaborator` is limited to viewing and deploying it.
 */
export type SiteRole = 'owner' | 'collaborator';
export interface DashboardUser {
    username: string;
    /** Encoded scrypt hash — see {@link hashPassword}. Never a plaintext password. */
    passwordHash: string;
    role: BoxRole;
    /** Site name → role. Ignored for admins, who reach every site. */
    sites: Record<string, SiteRole>;
    /** Display name shown in the UI. Defaults to the username. */
    name?: string;
    /** Verified once an emailed invitation or verification link is consumed. */
    email?: string;
    createdAt?: string;
}
/**
 * Everything the dashboard can be asked to do.
 *
 * `box:*` capabilities are admin-only. `site:*` capabilities are evaluated
 * against a specific site and may be granted to a member.
 */
export type Capability = 'box:read' | 'box:shell' | 'box:ssh' | 'box:firewall' | 'box:database' | 'box:config' | 'box:sites:create' | 'box:sites:delete' | 'box:serverless' | 'box:users' | 'site:read' | 'site:deploy' | 'site:settings';
/**
 * Capabilities that are never grantable to a member, for any site. Listed
 * explicitly so that adding a `site:*` capability can't silently widen a
 * member's reach into box-level control.
 */
export declare function isBoxCapability(capability: Capability): boolean;
export interface AuthorizeInput {
    user: Pick<DashboardUser, 'role' | 'sites'>;
    capability: Capability;
    /** Required for every `site:*` capability; ignored for `box:*`. */
    site?: string;
}
/**
 * The single authorization decision point. Deny-by-default: an unrecognized
 * capability, a missing site, or a site the member holds no grant on all
 * return `false`.
 */
export declare function authorize({ user, capability, site }: AuthorizeInput): boolean;
/** The sites a user may see. Admins see everything, so pass the full list. */
export declare function visibleSites(user: Pick<DashboardUser, 'role' | 'sites'>, allSites: string[]): string[];
/**
 * Hash a password for storage: `scrypt$N$r$p$salt$hash` (both salt and hash
 * base64url). The parameters travel with the hash so they can be raised later
 * without invalidating existing credentials.
 */
export declare function hashPassword(password: string): string;
/**
 * Verify a password against an encoded hash, in constant time. Returns false
 * for malformed hashes rather than throwing — a corrupt user record must fail
 * the login, not crash the server.
 */
export declare function verifyPassword(password: string, stored: string): boolean;
/** Whether a valid legacy hash should be transparently upgraded after login. */
export declare function passwordNeedsRehash(stored: string): boolean;
/** A URL-safe generated password, for invites and the bootstrap admin. */
export declare function generatePassword(): string;
