/**
 * Tool-Level Permission System
 *
 * 6 permission scopes, 4 roles.
 * Each tool declares a required scope.
 * Permission check runs before handler execution.
 *
 * FAIL FAST: Unauthorized access throws immediately.
 *
 * CRITICAL: NEVER use console.log() - stdout is reserved for JSON-RPC protocol.
 *
 * @module server/permissions
 */
export type PermissionScope = 'ocr:read' | 'ocr:write' | 'ocr:review' | 'ocr:configure' | 'ocr:delete' | 'ocr:admin';
export type UserRole = 'viewer' | 'reviewer' | 'editor' | 'admin';
/** Check if a role has a specific permission scope */
export declare function hasPermission(role: UserRole, scope: PermissionScope): boolean;
/** Get all scopes for a role */
export declare function getScopesForRole(role: UserRole): PermissionScope[];
/** Validate that a role string is valid */
export declare function isValidRole(role: string): role is UserRole;
/** Tool name to required scope mapping */
export declare const TOOL_SCOPES: Record<string, PermissionScope>;
/** Check permission - returns true if allowed, false if denied. Admin always passes. */
export declare function checkToolPermission(toolName: string, userRole: UserRole | null): boolean;
//# sourceMappingURL=permissions.d.ts.map