import { ReadonlySignal } from './signal';
/** Roles ordered from highest to lowest privilege. */
declare const ROLE_HIERARCHY: readonly ["superadmin", "admin", "syncer", "member"];
export type UserProjectRole = (typeof ROLE_HIERARCHY)[number];
/** Role a user can have within an organization. */
export type UserOrgRole = 'admin' | 'member';
export interface Privileges {
    changeContentCategories: boolean;
    createEntities: boolean;
    createProject: boolean;
    createProvider: boolean;
    deleteDocuments: boolean;
    deleteProject: boolean;
    deleteUserFromProject: boolean;
    downloadDocuments: boolean;
    editContentCategories: boolean;
    editPublicReposAvailableToAgent: boolean;
    editTier: boolean;
    inviteUserToProject: boolean;
    rebuildIndex: boolean;
    refreshStats: boolean;
    renameDocuments: boolean;
    uploadDocuments: boolean;
    viewAdvancedStats: boolean;
    viewCredits: boolean;
    viewEntities: boolean;
}
/**
 * Minimum project role required for each privilege.
 * Note: `createProject` is intentionally absent — it is gated by the
 * user's organisation role, not their project role.
 */
export declare const REQUIRED_ROLES: Record<Exclude<keyof Privileges, 'createProject'>, UserProjectRole>;
/**
 * Manages role-based access control for the current user + selected project.
 *
 * - Call `setProjectRoles()` whenever the selected project changes.
 * - Call `setOrgRole()` whenever the selected project's organisation changes.
 * - Read `privileges` (a `ReadonlySignal<Privileges>`) for reactive access.
 *
 * @example
 * cue.privileges.setProjectRoles(['admin']);
 * cue.privileges.setOrgRole('admin');
 * const canUpload = cue.privileges.privileges.get().uploadDocuments; // true
 * const canCreate = cue.privileges.privileges.get().createProject;  // true
 */
export declare class CuePrivileges {
    private readonly _isSuperAdmin;
    private readonly _projectRoles;
    private readonly _orgRole;
    /**
     * Reactive signal — current user's privileges for the selected project.
     * Recomputes automatically when `setProjectRoles()` is called or when
     * the `isSuperAdmin` signal changes.
     */
    readonly privileges: ReadonlySignal<Privileges>;
    constructor(_isSuperAdmin: ReadonlySignal<boolean>);
    /**
     * Set the user's role within the organisation that owns the selected project.
     * Pass `null` to clear the organisation role (e.g. when deselecting a project).
     *
     * Only organisation admins (and superadmins) may create projects.
     */
    setOrgRole(role: UserOrgRole | null): void;
    /**
     * Set the user's roles for the currently selected project.
     *
     * Roles are expanded along the hierarchy: `admin` automatically includes
     * `syncer` and `member`; `syncer` includes `member`. Pass an empty array
     * to reset to the lowest privilege level.
     */
    setProjectRoles(roles: UserProjectRole[]): void;
    private _expand;
    private _compute;
}
export {};