@plakboek/permissions 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,689 @@
+//#region src/catalogue.d.ts
+/**
+ * The frozen permission catalogue. This is the single source of truth for
+ * every permission string in the system (USER-05): it is owned by this
+ * package, exported read-only, and cannot be altered per installation.
+ *
+ * Label/description values are Lingui MessageDescriptor-compatible plain
+ * objects (`{ id, message }`). This package has zero runtime dependencies
+ * (D-16): it never imports `@lingui/core` itself, it only ships the message
+ * ids and English source text for a later phase's admin shell to resolve.
+ *
+ * Permission strings are `resource:action` with no own/any ownership split
+ * (D-05); publishing is always its own permission, separate from editing
+ * (D-06). This is the full v1 catalogue (D-07) — 45 permissions across 12
+ * groups. Per D-11 no wildcard or superadmin flag is added here; superadmin
+ * is a plain role holding `ALL_PERMISSIONS` (plan 01-04). Which of these
+ * permissions land on the shipped `admin` vs `superadmin` default role is
+ * also plan 01-04's concern — this file only defines what each permission
+ * string means, not who holds it by default.
+ */
+/** A Lingui MessageDescriptor-compatible plain object: `id` is the Lingui
+ * message key, `message` is the English source text. */
+type PermissionMessage = {
+  readonly id: string;
+  readonly message: string;
+};
+/** Metadata carried by every catalogue entry. */
+type PermissionMeta = {
+  readonly group: PermissionGroup;
+  readonly label: PermissionMessage;
+  readonly description: PermissionMessage;
+};
+/** The 12 v1 permission groups, in catalogue table order. */
+type PermissionGroup = 'pages' | 'entries' | 'templates' | 'content-types' | 'media' | 'menus' | 'seo' | 'users' | 'audit' | 'settings' | 'api' | 'backups';
+/**
+ * The frozen v1 permission catalogue (D-07). Every catalogue entry uses
+ * `resource:action` strings with no ownership split (D-05); publishing is
+ * its own permission, separate from editing (D-06).
+ */
+export declare const PERMISSIONS: {
+  readonly 'pages:read': {
+    readonly group: 'pages';
+    readonly label: {
+      readonly id: 'permissions.pages.read.label';
+      readonly message: 'View pages';
+    };
+    readonly description: {
+      readonly id: 'permissions.pages.read.description';
+      readonly message: 'See pages and their published content in the admin';
+    };
+  };
+  readonly 'pages:read-drafts': {
+    readonly group: 'pages';
+    readonly label: {
+      readonly id: 'permissions.pages.readDrafts.label';
+      readonly message: 'View page drafts';
+    };
+    readonly description: {
+      readonly id: 'permissions.pages.readDrafts.description';
+      readonly message: 'See unpublished drafts, previews and revision history of pages';
+    };
+  };
+  readonly 'pages:create': {
+    readonly group: 'pages';
+    readonly label: {
+      readonly id: 'permissions.pages.create.label';
+      readonly message: 'Create pages';
+    };
+    readonly description: {
+      readonly id: 'permissions.pages.create.description';
+      readonly message: 'Add new pages to the site';
+    };
+  };
+  readonly 'pages:edit': {
+    readonly group: 'pages';
+    readonly label: {
+      readonly id: 'permissions.pages.edit.label';
+      readonly message: 'Edit pages';
+    };
+    readonly description: {
+      readonly id: 'permissions.pages.edit.description';
+      readonly message: 'Change page content, blocks, layout, SEO fields and translations as drafts';
+    };
+  };
+  readonly 'pages:publish': {
+    readonly group: 'pages';
+    readonly label: {
+      readonly id: 'permissions.pages.publish.label';
+      readonly message: 'Publish pages';
+    };
+    readonly description: {
+      readonly id: 'permissions.pages.publish.description';
+      readonly message: 'Publish or schedule page drafts so visitors receive them';
+    };
+  };
+  readonly 'pages:delete': {
+    readonly group: 'pages';
+    readonly label: {
+      readonly id: 'permissions.pages.delete.label';
+      readonly message: 'Delete pages';
+    };
+    readonly description: {
+      readonly id: 'permissions.pages.delete.description';
+      readonly message: 'Move pages to the trash and restore them';
+    };
+  };
+  readonly 'pages:delete-permanent': {
+    readonly group: 'pages';
+    readonly label: {
+      readonly id: 'permissions.pages.deletePermanent.label';
+      readonly message: 'Permanently delete pages';
+    };
+    readonly description: {
+      readonly id: 'permissions.pages.deletePermanent.description';
+      readonly message: 'Permanently remove trashed pages';
+    };
+  };
+  readonly 'entries:read': {
+    readonly group: 'entries';
+    readonly label: {
+      readonly id: 'permissions.entries.read.label';
+      readonly message: 'View entries';
+    };
+    readonly description: {
+      readonly id: 'permissions.entries.read.description';
+      readonly message: 'See content entries and their published content in the admin';
+    };
+  };
+  readonly 'entries:read-drafts': {
+    readonly group: 'entries';
+    readonly label: {
+      readonly id: 'permissions.entries.readDrafts.label';
+      readonly message: 'View entry drafts';
+    };
+    readonly description: {
+      readonly id: 'permissions.entries.readDrafts.description';
+      readonly message: 'See unpublished drafts, previews and revision history of entries';
+    };
+  };
+  readonly 'entries:create': {
+    readonly group: 'entries';
+    readonly label: {
+      readonly id: 'permissions.entries.create.label';
+      readonly message: 'Create entries';
+    };
+    readonly description: {
+      readonly id: 'permissions.entries.create.description';
+      readonly message: 'Add new content entries';
+    };
+  };
+  readonly 'entries:edit': {
+    readonly group: 'entries';
+    readonly label: {
+      readonly id: 'permissions.entries.edit.label';
+      readonly message: 'Edit entries';
+    };
+    readonly description: {
+      readonly id: 'permissions.entries.edit.description';
+      readonly message: 'Change entry fields and translations as drafts';
+    };
+  };
+  readonly 'entries:publish': {
+    readonly group: 'entries';
+    readonly label: {
+      readonly id: 'permissions.entries.publish.label';
+      readonly message: 'Publish entries';
+    };
+    readonly description: {
+      readonly id: 'permissions.entries.publish.description';
+      readonly message: 'Publish or schedule entry drafts so visitors receive them';
+    };
+  };
+  readonly 'entries:delete': {
+    readonly group: 'entries';
+    readonly label: {
+      readonly id: 'permissions.entries.delete.label';
+      readonly message: 'Delete entries';
+    };
+    readonly description: {
+      readonly id: 'permissions.entries.delete.description';
+      readonly message: 'Move entries to the trash and restore them';
+    };
+  };
+  readonly 'entries:delete-permanent': {
+    readonly group: 'entries';
+    readonly label: {
+      readonly id: 'permissions.entries.deletePermanent.label';
+      readonly message: 'Permanently delete entries';
+    };
+    readonly description: {
+      readonly id: 'permissions.entries.deletePermanent.description';
+      readonly message: 'Permanently remove trashed entries';
+    };
+  };
+  readonly 'templates:edit': {
+    readonly group: 'templates';
+    readonly label: {
+      readonly id: 'permissions.templates.edit.label';
+      readonly message: 'Edit detail templates';
+    };
+    readonly description: {
+      readonly id: 'permissions.templates.edit.description';
+      readonly message: "Change the shared block tree used to render a content type's detail pages";
+    };
+  };
+  readonly 'templates:publish': {
+    readonly group: 'templates';
+    readonly label: {
+      readonly id: 'permissions.templates.publish.label';
+      readonly message: 'Publish detail templates';
+    };
+    readonly description: {
+      readonly id: 'permissions.templates.publish.description';
+      readonly message: 'Publish changes to shared detail templates';
+    };
+  };
+  readonly 'content-types:read': {
+    readonly group: 'content-types';
+    readonly label: {
+      readonly id: 'permissions.contentTypes.read.label';
+      readonly message: 'View content types';
+    };
+    readonly description: {
+      readonly id: 'permissions.contentTypes.read.description';
+      readonly message: 'See content types and the fields attached to them';
+    };
+  };
+  readonly 'content-types:create': {
+    readonly group: 'content-types';
+    readonly label: {
+      readonly id: 'permissions.contentTypes.create.label';
+      readonly message: 'Create content types';
+    };
+    readonly description: {
+      readonly id: 'permissions.contentTypes.create.description';
+      readonly message: 'Add new content types';
+    };
+  };
+  readonly 'content-types:edit': {
+    readonly group: 'content-types';
+    readonly label: {
+      readonly id: 'permissions.contentTypes.edit.label';
+      readonly message: 'Edit content types';
+    };
+    readonly description: {
+      readonly id: 'permissions.contentTypes.edit.description';
+      readonly message: 'Change content type settings and add, change or remove fields';
+    };
+  };
+  readonly 'content-types:delete': {
+    readonly group: 'content-types';
+    readonly label: {
+      readonly id: 'permissions.contentTypes.delete.label';
+      readonly message: 'Delete content types';
+    };
+    readonly description: {
+      readonly id: 'permissions.contentTypes.delete.description';
+      readonly message: 'Remove content types';
+    };
+  };
+  readonly 'media:read': {
+    readonly group: 'media';
+    readonly label: {
+      readonly id: 'permissions.media.read.label';
+      readonly message: 'View media';
+    };
+    readonly description: {
+      readonly id: 'permissions.media.read.description';
+      readonly message: 'Browse and search the media library';
+    };
+  };
+  readonly 'media:upload': {
+    readonly group: 'media';
+    readonly label: {
+      readonly id: 'permissions.media.upload.label';
+      readonly message: 'Upload media';
+    };
+    readonly description: {
+      readonly id: 'permissions.media.upload.description';
+      readonly message: 'Upload images and files';
+    };
+  };
+  readonly 'media:edit': {
+    readonly group: 'media';
+    readonly label: {
+      readonly id: 'permissions.media.edit.label';
+      readonly message: 'Edit media';
+    };
+    readonly description: {
+      readonly id: 'permissions.media.edit.description';
+      readonly message: 'Change alt text, copyright labels and replace assets in place';
+    };
+  };
+  readonly 'media:delete': {
+    readonly group: 'media';
+    readonly label: {
+      readonly id: 'permissions.media.delete.label';
+      readonly message: 'Delete media';
+    };
+    readonly description: {
+      readonly id: 'permissions.media.delete.description';
+      readonly message: 'Delete assets, including ones still in use after a warning';
+    };
+  };
+  readonly 'menus:read': {
+    readonly group: 'menus';
+    readonly label: {
+      readonly id: 'permissions.menus.read.label';
+      readonly message: 'View menus';
+    };
+    readonly description: {
+      readonly id: 'permissions.menus.read.description';
+      readonly message: 'See menus declared by the site and their links';
+    };
+  };
+  readonly 'menus:edit': {
+    readonly group: 'menus';
+    readonly label: {
+      readonly id: 'permissions.menus.edit.label';
+      readonly message: 'Edit menus';
+    };
+    readonly description: {
+      readonly id: 'permissions.menus.edit.description';
+      readonly message: 'Add, remove and re-arrange menu links';
+    };
+  };
+  readonly 'redirects:read': {
+    readonly group: 'seo';
+    readonly label: {
+      readonly id: 'permissions.redirects.read.label';
+      readonly message: 'View redirects';
+    };
+    readonly description: {
+      readonly id: 'permissions.redirects.read.description';
+      readonly message: 'See redirects and how long each has been active';
+    };
+  };
+  readonly 'redirects:manage': {
+    readonly group: 'seo';
+    readonly label: {
+      readonly id: 'permissions.redirects.manage.label';
+      readonly message: 'Manage redirects';
+    };
+    readonly description: {
+      readonly id: 'permissions.redirects.manage.description';
+      readonly message: 'Create, change and remove redirects';
+    };
+  };
+  readonly 'users:read': {
+    readonly group: 'users';
+    readonly label: {
+      readonly id: 'permissions.users.read.label';
+      readonly message: 'View users';
+    };
+    readonly description: {
+      readonly id: 'permissions.users.read.description';
+      readonly message: 'See users and their roles';
+    };
+  };
+  readonly 'users:create': {
+    readonly group: 'users';
+    readonly label: {
+      readonly id: 'permissions.users.create.label';
+      readonly message: 'Invite users';
+    };
+    readonly description: {
+      readonly id: 'permissions.users.create.description';
+      readonly message: 'Add users and send or resend set-password emails';
+    };
+  };
+  readonly 'users:edit': {
+    readonly group: 'users';
+    readonly label: {
+      readonly id: 'permissions.users.edit.label';
+      readonly message: 'Edit users';
+    };
+    readonly description: {
+      readonly id: 'permissions.users.edit.description';
+      readonly message: "Change other users' profile details";
+    };
+  };
+  readonly 'users:deactivate': {
+    readonly group: 'users';
+    readonly label: {
+      readonly id: 'permissions.users.deactivate.label';
+      readonly message: 'Deactivate users';
+    };
+    readonly description: {
+      readonly id: 'permissions.users.deactivate.description';
+      readonly message: 'Deactivate and reactivate users';
+    };
+  };
+  readonly 'users:assign-roles': {
+    readonly group: 'users';
+    readonly label: {
+      readonly id: 'permissions.users.assignRoles.label';
+      readonly message: 'Assign roles';
+    };
+    readonly description: {
+      readonly id: 'permissions.users.assignRoles.description';
+      readonly message: 'Assign a code-defined role to a user';
+    };
+  };
+  readonly 'users:reset-password': {
+    readonly group: 'users';
+    readonly label: {
+      readonly id: 'permissions.users.resetPassword.label';
+      readonly message: 'Reset passwords';
+    };
+    readonly description: {
+      readonly id: 'permissions.users.resetPassword.description';
+      readonly message: "Set or reset another user's password";
+    };
+  };
+  readonly 'users:impersonate': {
+    readonly group: 'users';
+    readonly label: {
+      readonly id: 'permissions.users.impersonate.label';
+      readonly message: 'Impersonate users';
+    };
+    readonly description: {
+      readonly id: 'permissions.users.impersonate.description';
+      readonly message: 'Act as another user and return to your own session';
+    };
+  };
+  readonly 'audit-log:read': {
+    readonly group: 'audit';
+    readonly label: {
+      readonly id: 'permissions.auditLog.read.label';
+      readonly message: 'View audit log';
+    };
+    readonly description: {
+      readonly id: 'permissions.auditLog.read.description';
+      readonly message: 'See the audit log of data-changing actions';
+    };
+  };
+  readonly 'settings:read': {
+    readonly group: 'settings';
+    readonly label: {
+      readonly id: 'permissions.settings.read.label';
+      readonly message: 'View settings';
+    };
+    readonly description: {
+      readonly id: 'permissions.settings.read.description';
+      readonly message: 'See installation settings';
+    };
+  };
+  readonly 'settings:manage': {
+    readonly group: 'settings';
+    readonly label: {
+      readonly id: 'permissions.settings.manage.label';
+      readonly message: 'Manage settings';
+    };
+    readonly description: {
+      readonly id: 'permissions.settings.manage.description';
+      readonly message: 'Change core configuration, styles and rules';
+    };
+  };
+  readonly 'modules:manage': {
+    readonly group: 'settings';
+    readonly label: {
+      readonly id: 'permissions.modules.manage.label';
+      readonly message: 'Manage modules';
+    };
+    readonly description: {
+      readonly id: 'permissions.modules.manage.description';
+      readonly message: 'Turn installation modules on or off';
+    };
+  };
+  readonly 'blocks:manage': {
+    readonly group: 'settings';
+    readonly label: {
+      readonly id: 'permissions.blocks.manage.label';
+      readonly message: 'Manage built-in blocks';
+    };
+    readonly description: {
+      readonly id: 'permissions.blocks.manage.description';
+      readonly message: 'Turn individual built-in sections and blocks on or off';
+    };
+  };
+  readonly 'bootstrap:run': {
+    readonly group: 'settings';
+    readonly label: {
+      readonly id: 'permissions.bootstrap.run.label';
+      readonly message: 'Run bootstrap';
+    };
+    readonly description: {
+      readonly id: 'permissions.bootstrap.run.description';
+      readonly message: 'Run installation bootstrap steps';
+    };
+  };
+  readonly 'api-tokens:create': {
+    readonly group: 'api';
+    readonly label: {
+      readonly id: 'permissions.apiTokens.create.label';
+      readonly message: 'Create API tokens';
+    };
+    readonly description: {
+      readonly id: 'permissions.apiTokens.create.description';
+      readonly message: 'Create and revoke your own API tokens for MCP clients';
+    };
+  };
+  readonly 'api-tokens:manage': {
+    readonly group: 'api';
+    readonly label: {
+      readonly id: 'permissions.apiTokens.manage.label';
+      readonly message: 'Manage API tokens';
+    };
+    readonly description: {
+      readonly id: 'permissions.apiTokens.manage.description';
+      readonly message: "See and revoke any user's API tokens";
+    };
+  };
+  readonly 'backups:manage': {
+    readonly group: 'backups';
+    readonly label: {
+      readonly id: 'permissions.backups.manage.label';
+      readonly message: 'Manage backups';
+    };
+    readonly description: {
+      readonly id: 'permissions.backups.manage.description';
+      readonly message: 'Configure backup targets and run backups';
+    };
+  };
+  readonly 'backups:restore': {
+    readonly group: 'backups';
+    readonly label: {
+      readonly id: 'permissions.backups.restore.label';
+      readonly message: 'Restore backups';
+    };
+    readonly description: {
+      readonly id: 'permissions.backups.restore.description';
+      readonly message: 'Restore the installation from a backup';
+    };
+  };
+};
+/** The union of every valid permission string, derived from the catalogue. */
+type Permission = keyof typeof PERMISSIONS;
+/** Runtime type guard for an arbitrary value being a known permission string.
+ * Uses `Object.hasOwn` (not `in` or bracket access) so inherited
+ * `Object.prototype` keys (`constructor`, `toString`, `__proto__`, ...) are
+ * never classified as permissions (T-01-08). */
+export declare function isPermission(value: unknown): value is Permission;
+/** Every permission string, in catalogue declaration order, frozen. */
+export declare const ALL_PERMISSIONS: readonly Permission[];
+/** The 12 v1 permission groups, in catalogue table order, frozen. */
+export declare const PERMISSION_GROUPS: readonly PermissionGroup[];
+//#endregion
+//#region src/deprecated.d.ts
+/**
+ * D-09 breaking-change policy for permission strings:
+ *
+ * - Adding a permission is a minor version bump.
+ * - Renaming or removing a permission is a major version bump (while
+ *   pre-1.0, per D-17, it is a minor bump instead) -- and the old name
+ *   stays in this table, pointing at its replacement, for one major
+ *   version after the rename/removal ships. Host configs that still
+ *   reference the old name keep booting, with a warning (D-10); they are
+ *   never rejected outright during that window.
+ * - An alias key must never equal a canonical key in `PERMISSIONS`
+ *   (catalogue.ts) -- a key that renames back onto itself is not a
+ *   deprecation, it is a bug in this table.
+ *
+ * No permission has been renamed or removed since the v1 catalogue shipped
+ * at 0.1.0, so this table starts empty. `DeprecatedPermission` (`keyof
+ * typeof DEPRECATED_PERMISSION_ALIASES`) is therefore `never` today -- that
+ * is intentional and still a literal type, not `string`: the first entry
+ * added here narrows it to a real literal union, it never widens.
+ */
+export declare const DEPRECATED_PERMISSION_ALIASES: {};
+/** The union of every deprecated (renamed/removed) permission alias key. */
+type DeprecatedPermission = keyof typeof DEPRECATED_PERMISSION_ALIASES;
+/** The result of classifying an arbitrary string against the catalogue and
+ * the deprecated-alias table. */
+type PermissionNameResolution = {
+  readonly kind: 'canonical';
+  readonly permission: Permission;
+} | {
+  readonly kind: 'deprecated';
+  readonly alias: string;
+  readonly permission: Permission;
+} | {
+  readonly kind: 'unknown';
+  readonly value: string;
+};
+/**
+ * Classify an arbitrary string as a canonical permission, a deprecated
+ * alias (per `aliases`, defaulting to the shipped
+ * `DEPRECATED_PERMISSION_ALIASES`), or unknown.
+ *
+ * Checks `isPermission` first so a canonical name is never misclassified
+ * as deprecated even if it were accidentally also present as an alias key.
+ * Alias lookup uses `Object.hasOwn` (not `in` or bracket access), so
+ * inherited `Object.prototype` keys (`__proto__`, `constructor`, ...) are
+ * always classified as unknown, never as a hit (T-01-08).
+ */
+export declare function resolvePermissionName(value: string, aliases?: Readonly<Record<string, Permission>>): PermissionNameResolution;
+//#endregion
+//#region src/roles.d.ts
+/** A single role's permission list, as a host writes it: canonical
+ * `Permission` strings, or a still-accepted deprecated alias (D-09).
+ * `DeprecatedPermission` is `never` at 0.1.0 (no permission has been
+ * renamed/removed yet, see deprecated.ts) -- the union is written this way
+ * deliberately so it widens automatically the day the alias table gets its
+ * first real entry, without this type needing to change. */
+type RolePermissionList = readonly (Permission | DeprecatedPermission)[];
+/**
+ * The shape a host passes to `defineRoles`. `superadmin` is a required,
+ * reserved key (D-12); any other lowercase-kebab role key maps to its own
+ * permission list.
+ */
+type RoleConfig = Readonly<Record<string, RolePermissionList>> & {
+  readonly superadmin: RolePermissionList;
+};
+/** The validated, normalized result of `defineRoles`/`validateRoleConfig`:
+ * every role's permissions are deduped, catalogue-ordered `Permission`
+ * strings (deprecated aliases already resolved to their canonical name). */
+type DefinedRoles<K extends string = string> = Readonly<Record<K, readonly Permission[]>>;
+/** Emitted once per deprecated permission string accepted into a role. */
+type DeprecatedPermissionEvent = {
+  readonly roleKey: string;
+  readonly alias: string;
+  readonly permission: Permission;
+};
+type DefineRolesOptions = {
+  onDeprecatedPermission?: (event: DeprecatedPermissionEvent) => void;
+};
+type RoleConfigIssueCode = 'MISSING_SUPERADMIN' | 'SUPERADMIN_NOT_ALL_PERMISSIONS' | 'UNKNOWN_PERMISSION' | 'INVALID_ROLE_KEY' | 'INVALID_PERMISSION_LIST' | 'INVALID_ROLE_CONFIG';
+type RoleConfigIssue = {
+  readonly code: RoleConfigIssueCode;
+  readonly roleKey?: string;
+  readonly value?: string;
+  readonly message: string;
+};
+/** Thrown by `defineRoles`/`validateRoleConfig` with every problem found in
+ * the config, collected before throwing once (never one-issue-at-a-time). */
+export declare class RoleConfigError extends Error {
+  readonly issues: readonly RoleConfigIssue[];
+  constructor(issues: readonly RoleConfigIssue[]);
+}
+/**
+ * Validate and normalize a host's role config. Throws a single
+ * `RoleConfigError` listing every problem found; on success, returns a
+ * frozen, deduped, catalogue-ordered permission map per role.
+ */
+export declare function defineRoles<const T extends RoleConfig>(roles: T, options?: DefineRolesOptions): DefinedRoles<Extract<keyof T, string>>;
+/**
+ * The shipped `superadmin`/`admin`/`editor` role set (D-13). Works with
+ * zero customisation (USER-04); hosts compose via
+ * `defineRoles({ ...defaultRoles, client: [...] })` (D-14).
+ */
+export declare const defaultRoles: {
+  readonly superadmin: readonly ("api-tokens:create" | "api-tokens:manage" | "audit-log:read" | "backups:manage" | "backups:restore" | "blocks:manage" | "bootstrap:run" | "content-types:create" | "content-types:delete" | "content-types:edit" | "content-types:read" | "entries:create" | "entries:delete" | "entries:delete-permanent" | "entries:edit" | "entries:publish" | "entries:read" | "entries:read-drafts" | "media:delete" | "media:edit" | "media:read" | "media:upload" | "menus:edit" | "menus:read" | "modules:manage" | "pages:create" | "pages:delete" | "pages:delete-permanent" | "pages:edit" | "pages:publish" | "pages:read" | "pages:read-drafts" | "redirects:manage" | "redirects:read" | "settings:manage" | "settings:read" | "templates:edit" | "templates:publish" | "users:assign-roles" | "users:create" | "users:deactivate" | "users:edit" | "users:impersonate" | "users:read" | "users:reset-password")[];
+  readonly admin: readonly ["pages:read", "pages:read-drafts", "pages:create", "pages:edit", "pages:publish", "pages:delete", "entries:read", "entries:read-drafts", "entries:create", "entries:edit", "entries:publish", "entries:delete", "templates:edit", "templates:publish", "content-types:read", "content-types:create", "content-types:edit", "content-types:delete", "media:read", "media:upload", "media:edit", "media:delete", "menus:read", "menus:edit", "redirects:read", "redirects:manage", "users:read", "users:create", "users:edit", "users:deactivate", "users:assign-roles", "users:reset-password", "audit-log:read", "settings:read", "settings:manage", "api-tokens:create", "api-tokens:manage"];
+  readonly editor: readonly ["pages:read", "pages:read-drafts", "pages:create", "pages:edit", "pages:publish", "pages:delete", "entries:read", "entries:read-drafts", "entries:create", "entries:edit", "entries:publish", "entries:delete", "templates:edit", "templates:publish", "content-types:read", "media:read", "media:upload", "media:edit", "menus:read", "menus:edit", "redirects:read", "api-tokens:create"];
+};
+//#endregion
+//#region src/resolve.d.ts
+/** Emitted when `resolve` is asked for a role key absent from the code role
+ * map. Carries only the role key, the opaque user id (when known), when it
+ * happened, and how many prior lookups for this same key were suppressed
+ * by the rate limit -- never anything else about the user (T-01-23). */
+type OrphanedRoleEvent = {
+  readonly roleKey: string;
+  readonly userId?: string;
+  readonly occurredAt: Date;
+  readonly suppressedCount: number;
+};
+type OrphanedRoleHook = (event: OrphanedRoleEvent) => void;
+type PermissionResolverOptions = {
+  onOrphanedRole?: OrphanedRoleHook;
+  rateLimitMs?: number;
+  now?: () => number;
+};
+type PermissionResolver = {
+  resolve(roleKey: string, context?: {
+    userId?: string;
+  }): ReadonlySet<Permission>;
+  isKnownRole(roleKey: string): boolean;
+};
+/**
+ * Build a resolver over a validated role map (the output of `defineRoles`).
+ * `resolve` never throws: an unknown role key returns an empty set and
+ * reports the orphan through `onOrphanedRole` (default `console.warn`),
+ * rate-limited independently per key.
+ */
+export declare function createPermissionResolver(roles: DefinedRoles, options?: PermissionResolverOptions): PermissionResolver;
+//#endregion
+export type { DefineRolesOptions, DefinedRoles, DeprecatedPermission, DeprecatedPermissionEvent, OrphanedRoleEvent, OrphanedRoleHook, Permission, PermissionGroup, PermissionMessage, PermissionMeta, PermissionNameResolution, PermissionResolver, PermissionResolverOptions, RoleConfig, RoleConfigIssue, RoleConfigIssueCode, RolePermissionList };