import type { RbacConfig, RbacRole, PermissionAction, PermissionResult, RbacAuditEntry } from '../../types/index.js';
/**
 * Check whether a user is allowed to perform an action on a resource.
 *
 * When RBAC is disabled (default single-user mode) this is always a no-op
 * that returns allowed=true — preserving backward compatibility.
 *
 * Resolution order:
 *   1. RBAC disabled → allow
 *   2. Find spec-scoped assignment (most specific)
 *   3. Find project-level assignment
 *   4. No assignment found → deny
 */
export declare function checkPermission(config: RbacConfig, userId: string, action: PermissionAction, resource: string, specId?: string): PermissionResult;
/**
 * Resolve the effective role for a user.
 * Spec-scoped assignments take precedence over project-level assignments.
 */
export declare function resolveRole(config: RbacConfig, userId: string, specId?: string): RbacRole | undefined;
export declare function buildAuditEntry(userId: string, action: PermissionAction, resource: string, result: PermissionResult, specId?: string): RbacAuditEntry;
//# sourceMappingURL=permission-checker.d.ts.map