import { type HygieneCommonOptions } from "../shared.js";
export interface CleanupRolesOptions extends HygieneCommonOptions {
    /** Restrict to a specific domain. */
    domain?: string;
    /** Cap on deletions. Default 50. */
    maxDeletions?: number;
    concurrency?: number;
    whatIf?: boolean;
    allowWrite?: boolean;
    baseline?: boolean;
    output?: string;
    format?: "json" | "csv" | "markdown";
    /**
     * Include Sitecore platform / built-in roles in the purge. Off by
     * default — built-in roles (Administrator, Author, every `Sitecore
     * Client …` role, every `Analytics …` and `Marketer …` role) ship
     * empty on a fresh tenant and remain empty until operators wire them
     * up; deleting them by mistake breaks the platform's role model and
     * the Items.AccessRights inheritance that depends on those roles
     * existing. Pass `--include-builtin` only after triple-checking the
     * audit output.
     */
    includeBuiltin?: boolean;
    /**
     * Additional role names to never delete, on top of the built-in skip
     * list. Match is case-insensitive and supports both the bare name and
     * the `domain\name` form.
     */
    alwaysSkip?: string[];
}
export interface RoleCleanupAction {
    name: string;
    domain: string | null;
    status: "deleted" | "what-if" | "failed";
    error?: string;
}
/**
 * Purge empty roles. Pairs with `audit empty-roles list`.
 *
 * Safety rails:
 *   - `--what-if` reports the plan without mutating.
 *   - `--allow-write` required outside `--what-if`.
 *   - `--max-deletions` caps per-run blast radius (default 50).
 *   - Sitecore built-in roles (sitecore\\Author, sitecore\\Developer,
 *     etc.) are surfaced by `audit empty-roles` only if they are
 *     genuinely empty. If they're empty by accident (after a user
 *     migration), deleting them breaks the platform's role model.
 *     Operators should review the audit output BEFORE running cleanup.
 *
 * Notes:
 *   - The Authoring API's `deleteRole` cascades — users in the role
 *     lose that membership. Empty roles have no members by definition,
 *     so no membership change.
 *   - Roles that are members of OTHER roles (via `Role.memberOf`)
 *     leave dangling memberships when deleted. We don't check that
 *     here; the cleanup is intentionally minimal.
 */
export declare const runCleanupRoles: (options: CleanupRolesOptions) => Promise<RoleCleanupAction[]>;