import { Permission } from "@opengeni/contracts";
import { organizationAdministrationAccountIds } from "../../organization-model.js";
import type { AccessContext } from "../types.js";
import type { Workspace } from "../types.js";
import { type ManagedSelfContext } from "./managed-self-context.js";
export type PermissionGroup = {
    label: string;
    permissions: Permission[];
};
export declare function buildApiKeyPermissionGroups(): PermissionGroup[];
export declare function apiKeyPermissionGroups(): PermissionGroup[];
export declare function delegableApiKeyPermissions(grantPermissions: readonly string[], accountGrantPermissions?: readonly string[]): Set<string>;
export declare const fixedOrganizationApiKeyPermissions: readonly ["account:read", "workspace:create", "workspace:read", "workspace:admin", "api_keys:manage"];
export declare const defaultApiKeyPermissions: Set<string>;
/**
 * Groups offered for a session's first-party MCP (Opengeni tool) permission
 * scope — the same grouped idiom as the API key dialog. Account-level scopes
 * are excluded: a session's Opengeni MCP only ever acts inside its workspace.
 */
export declare function buildSessionMcpPermissionGroups(): PermissionGroup[];
export declare function sessionMcpPermissionGroups(): PermissionGroup[];
/**
 * Groups offered when editing a workspace member's permissions. Workspace
 * scopes only: the account-level scopes (billing, account admin, member
 * management, workspace creation) are granted on the organization, not on a
 * per-workspace membership row, so they are excluded here. `members:manage`
 * and `workspace:admin` stay (they are workspace-scoped membership powers).
 */
export declare function buildWorkspaceMemberPermissionGroups(): PermissionGroup[];
export declare function workspaceMemberPermissionGroups(): PermissionGroup[];
/**
 * The default permission set for a newly-added workspace member: everything a
 * Viewer holds plus full teammate access (live control, terminal, file edits,
 * own connections, Sandbox Environments, Connected Machine picking, artifacts),
 * minus the settings/management powers an admin grants deliberately. Mirrors
 * the server's named `member` preset (migration 0865) exactly, order included.
 */
export declare const defaultWorkspaceMemberPermissions: Set<string>;
export type WorkspaceAccessLevel = "viewer" | "member" | "admin";
export type WorkspaceAccessLevelDefinition = {
    role: WorkspaceAccessLevel;
    label: string;
    description: string;
    permissions: readonly string[];
};
/**
 * Named workspace roles. These mirror the server catalog
 * (`opengeni_private.workspace_member_role_permissions`, returned as the
 * organization overview `roles`) exactly, labels and descriptions included;
 * keep them in sync when a migration changes a preset.
 */
export declare const workspaceAccessLevels: ReadonlyArray<WorkspaceAccessLevelDefinition>;
export declare function hasWorkspacePermission(context: AccessContext | null, workspaceId: string, permission: string): boolean;
/**
 * True only when the viewer's loaded grant for this workspace provably lacks
 * `permission`. A missing grant (still loading, local mode, or no access at
 * all) is not evidence of a narrower role.
 */
export declare function lacksWorkspacePermission(context: AccessContext | null, workspaceId: string, permission: string): boolean;
/** An authorization failure needs an access explanation, not a retry prompt. */
export declare function isWorkspacePermissionDenied(error: unknown): boolean;
export declare function hasAccountPermission(context: AccessContext | null, accountId: string, permission: string): boolean;
/** UI affordance only. The API independently authenticates Personal ownership. */
export declare function canManageWorkspaceSettings(context: AccessContext | null, workspace: Pick<Workspace, "id" | "accountId" | "kind"> | null, selfContext: ManagedSelfContext | null): boolean;
/**
 * A shared workspace's Members surface: the viewer's own members:manage grant,
 * or (in a managed browser session) an active organization owner or admin of
 * the workspace's organization, with or without a grant here. The API applies
 * the same organization authority; Personal workspaces never qualify.
 */
export declare function canManageWorkspaceMembers(context: AccessContext | null, workspace: Pick<Workspace, "id" | "accountId" | "kind"> | null, managedSession: boolean): boolean;
export { organizationAdministrationAccountIds };