import type { RbacRole, PermissionAction, RbacRoleConfig } from '../../types/index.js';
/**
 * Load all role definitions for an optional project, defaulting to system roles.
 * Returns a map from role id to its config entry.
 */
export declare function loadRoleConfigs(projectHash?: string): Map<string, RbacRoleConfig>;
/**
 * Permissions granted to each role (system defaults).
 * All roles implicitly support 'read' — it is always included.
 *
 * For runtime extensibility (custom roles added via org/project config),
 * use loadRoleConfigs(projectHash) instead.
 */
export declare const ROLE_PERMISSIONS: Readonly<Record<RbacRole, ReadonlySet<PermissionAction>>>;
export declare const ROLE_DESCRIPTIONS: Readonly<Record<RbacRole, string>>;
/** Returns true if the given role has the requested permission on any resource. */
export declare function roleHasPermission(role: string, action: PermissionAction): boolean;
/** Returns all roles defined in the system (or project if projectHash provided). */
export declare function listRoles(projectHash?: string): string[];
//# sourceMappingURL=roles.d.ts.map