import { type HygieneCommonOptions } from "../shared.js";
export interface AuditRoleBloatOptions extends HygieneCommonOptions {
    /** Role-count threshold per user. Default 10. */
    threshold?: number;
    /** Cap on users inspected. Default 5000. */
    limit?: number;
    /**
     * Include administrators in the audit. Off by default — admins
     * legitimately accumulate roles for emergency-access reasons.
     */
    includeAdmins?: boolean;
    concurrency?: number;
    baseline?: boolean;
    output?: string;
    format?: "json" | "csv" | "markdown";
}
export interface RoleBloatReport {
    user: string;
    isAdministrator: boolean;
    roleCount: number;
    roles: string[];
}
/**
 * Audit users with an unusually large number of role memberships.
 *
 * Strategy:
 *   1. List every user via `listUsers`.
 *   2. For each, fetch full detail (`getUserDetail`) to count
 *      direct role memberships.
 *   3. Flag users with `roleCount >= --threshold` (default 10).
 *
 * Notes:
 *   - This counts DIRECT memberships only — transitive roles (a user
 *     in role A, where role A is a member of role B) aren't summed.
 *     The Authoring API exposes `User.roles` as the direct set.
 *   - Administrators are excluded by default; pass `--include-admins`
 *     to include them.
 *   - The Authoring API doesn't expose role-permission detail per
 *     item, so this audit is a count signal, not an actual
 *     permission analysis.
 */
export declare const runAuditRoleBloat: (options: AuditRoleBloatOptions) => Promise<RoleBloatReport[]>;