import { COLLECTIONS } from './group-invitation-scopes';
/** `users` is not an invitation collection, but `user_full_access` grants it. */
export declare type ScopeCollection = (typeof COLLECTIONS)[number] | 'users';
export declare type UserScope = {
    canRead(collection: ScopeCollection): boolean;
    canWrite(collection: ScopeCollection): boolean;
    canResend(collection: ScopeCollection): boolean;
};
export declare type ScopeRule = {
    /** Control path (as used by `hiddencontrols` / `readonlycontrols`) this rule applies to. */
    path: string;
    collection: ScopeCollection;
    /** Permission required to show the control. Defaults to `read`. */
    need?: 'read' | 'write' | 'resend';
    /** Show the control, but make it readonly when the user cannot write the collection. */
    readonlyIfNoWrite?: boolean;
};
/**
 * Parses a space-separated API token scope. Returns `null` when the scope does not restrict
 * store collections (no scope, `store_full_access`, or no collection tokens), meaning the UI
 * must stay unchanged.
 */
export declare function parseUserScope(scope: string | null | undefined): UserScope | null;
/**
 * Returns `true` when the scope can read the collection, or when the scope does not restrict
 * store collections at all (unset, `store_full_access`, no collection tokens).
 */
export declare function canReadCollection(scope: string | null | undefined, collection: ScopeCollection): boolean;
/** Turns scope rules into control selectors to hide or make readonly. */
export declare function getScopeSelectors(scope: UserScope | null, rules: ScopeRule[], own: ScopeCollection | null): {
    hidden: string[];
    readonly: string[];
    readonlyAll: boolean;
};
/**
 * Removes the zoom paths the scope can't read from a URL. The API denies the whole request
 * when one zoomed resource can't be read. Returns the URL unchanged when the scope does not
 * restrict store collections.
 */
export declare function filterZoom(url: string, scope: string | null | undefined): string;