import type { AuditCache } from '@cclabsnz/sf-core';
import type { SecurityCheck } from '../checks/SecurityCheck.js';
export type AuditPermission = 'ApiEnabled' | 'ViewSetup' | 'ViewAllUsers' | 'ViewHealthCheckScreen' | 'AuthorApex' | 'ViewEventLogFiles';
export interface PermissionSpec {
    /** Field on UserPermissionAccess carrying the effective grant. */
    readonly field: string;
    readonly label: string;
    /** What the audit loses without it. */
    readonly impact: string;
    /**
     * Cache keys whose producers and consumers need this permission. The affected
     * check list is derived from the registry via these keys rather than hand-written,
     * so a check added later is covered without touching this file.
     *
     * Empty for permissions too broad to attribute to specific checks.
     */
    readonly cacheKeys: ReadonlyArray<keyof AuditCache>;
    /** The audit cannot run at all without this. */
    readonly blocking?: boolean;
}
export declare const AUDIT_PERMISSIONS: Readonly<Record<AuditPermission, PermissionSpec>>;
export declare const usesKey: (check: SecurityCheck, key: keyof AuditCache) => boolean;
/** Labels of the permissions this check's declared cache wiring needs; empty when none is attributable. */
export declare function permissionLabelsFor(check: SecurityCheck): string[];
//# sourceMappingURL=permissions.d.ts.map