/**
 * Member RBAC — role presets and scope resolution.
 *
 * Staff members are granted the SAME permission vocabulary as API keys
 * (`resource:action`, see ./api-keys), so one model and one `hasApiKeyPermission`
 * gate cover both. This module adds the people-facing layer: preset role bundles
 * (Admin / Editor / Viewer) and a resolver from a role slug to a scope set.
 *
 * Presets are NON-BINDING convenience defaults — the assignment UI lets an admin
 * start from a preset and then toggle any module's view/edit per member. See
 * docs/architecture/member-rbac-rfc.md (voyant#2085).
 */
import { type AccessCatalog, type ApiKeyPermissionString, type ApiKeyPermissions } from "./api-keys.js";
/**
 * Canonical staff role slugs. Mirrors the `roles` DB enum and the WorkOS org
 * roles a deployment maps from (`owner`/`admin` → admin; `member`/`viewer` →
 * editor/viewer). "custom" is any explicit set that matches no preset.
 */
export declare const MEMBER_ROLES: readonly ["super-admin", "admin", "editor", "viewer", "member", "guest", "custom"];
export type MemberRole = (typeof MEMBER_ROLES)[number];
export interface MemberRolePreset {
    label: string;
    description: string;
    permissions: ApiKeyPermissions;
}
/**
 * Named preset bundles. The assignment UI offers these as starting points; the
 * stored grant is the resolved permission set, not the preset name.
 */
export declare const MEMBER_ROLE_PRESETS: {
    readonly admin: {
        readonly label: "Admin";
        readonly description: "Full access, including team and settings.";
        readonly permissions: {
            readonly "*": ["*"];
        };
    };
    readonly editor: {
        readonly label: "Editor";
        readonly description: "Read and edit operational data (catalog, products, bookings, CRM, …). No team, settings, deletes, or finance writes by default.";
        readonly permissions: ApiKeyPermissions;
    };
    readonly viewer: {
        readonly label: "Viewer";
        readonly description: "Read-only access across every resource.";
        readonly permissions: {
            readonly "*": ["read", "search"];
        };
    };
};
export type MemberRolePresetKey = keyof typeof MEMBER_ROLE_PRESETS;
/**
 * Map a role slug (DB enum or WorkOS org role) to its preset permissions, or
 * `null` if the slug carries no preset (e.g. "custom" or unknown — the caller
 * then uses the member's explicitly-stored permission set).
 */
export declare function permissionsForRole(role: string | null | undefined): ApiKeyPermissions | null;
/**
 * Resolve a role slug to its scope strings (e.g. `["bookings:read", …]`), or
 * `null` for a slug with no preset. `admin`/`owner` resolve to `["*"]`.
 */
export declare function scopesForRole(role: string | null | undefined): ApiKeyPermissionString[] | null;
/**
 * Resolve a role slug to runtime session scopes. Full-access roles include the
 * explicit catalog grants that `*` intentionally does not satisfy, such as
 * team-management resources.
 */
export declare function accessCatalogScopesForRole(role: string | null | undefined, catalog: AccessCatalog | null | undefined): ApiKeyPermissionString[] | null;
/** True when a role slug grants full (manage-everything) access. */
export declare function isFullAccessRole(role: string | null | undefined): boolean;