import { SmrtCollection } from '@happyvertical/smrt-core';
import { RolePermission } from '../models/RolePermission.js';
import { PermissionCatalog } from '../services/PermissionCatalogService.js';
import { DefaultRoleSlug } from '../types/index.js';
export type RolePermissionPatternMatrix = Partial<Record<string, readonly string[]>>;
export interface SeedRolePermissionsOptions {
    catalog?: PermissionCatalog;
    /**
     * Remove existing role mappings not selected by the role's current patterns.
     * Defaults false to keep seeding additive and low-risk.
     */
    prune?: boolean;
    /**
     * Sync catalog definitions into the Permission table before assigning role
     * permissions. Defaults true.
     */
    syncCatalog?: boolean;
    tenantId?: string;
    /** @internal Restrict the matrix to system roles (tenantId null + isSystem). */
    systemRolesOnly?: boolean;
}
export interface SeedRolePermissionsResult {
    added: Record<string, string[]>;
    matched: Record<string, string[]>;
    missingPermissions: Record<string, string[]>;
    missingRoles: string[];
    removed: Record<string, string[]>;
    unchanged: Record<string, string[]>;
    unmatchedPatterns: Record<string, string[]>;
}
export declare const DEFAULT_ROLE_PERMISSION_PATTERNS: Record<DefaultRoleSlug, readonly string[]>;
/**
 * Collection for managing RolePermission objects
 */
export declare class RolePermissionCollection extends SmrtCollection<RolePermission> {
    static readonly _itemClass: typeof RolePermission;
    /**
     * Find all permissions for a role
     */
    findByRole(roleId: string): Promise<RolePermission[]>;
    /**
     * Find all roles that have a permission
     */
    findByPermission(permissionId: string): Promise<RolePermission[]>;
    /**
     * Check if a role has a specific permission
     */
    hasPermission(roleId: string, permissionId: string): Promise<boolean>;
    /**
     * Add a permission to a role
     */
    addPermission(roleId: string, permissionId: string): Promise<RolePermission>;
    /**
     * Remove a permission from a role
     */
    removePermission(roleId: string, permissionId: string): Promise<boolean>;
    /**
     * Get permission IDs for a role
     */
    getPermissionIds(roleId: string): Promise<string[]>;
    /**
     * Seed role-to-permission mappings from catalog-aware glob patterns.
     *
     * Defaults to the system owner/admin/member/viewer matrix. Re-running is
     * idempotent: existing mappings are reported as `unchanged`, new catalog
     * slugs are added, and stale mappings are only removed when `prune` is true.
     */
    seedRolePermissions(matrix?: RolePermissionPatternMatrix, options?: SeedRolePermissionsOptions): Promise<SeedRolePermissionsResult>;
    /**
     * Add the catalog-registered self-personalization grant to existing built-in
     * roles. This is the explicit, idempotent upgrade path for applications
     * whose roles predate the Fields permission; custom role matrices are never
     * considered here.
     */
    seedDefaultRolePersonalizationPermissions(options?: Omit<SeedRolePermissionsOptions, 'prune'>): Promise<SeedRolePermissionsResult>;
}
//# sourceMappingURL=RolePermissionCollection.d.ts.map