/**
 * NEXUS permission enforcement - three-tier access control for cross-project operations.
 *
 * Permission model:
 *   read (1)    - Query tasks, discover relationships
 *   write (2)   - read + modify task fields, add relationships
 *   execute (3) - write + create/delete tasks, run commands
 *
 * Hierarchical: execute includes write includes read.
 * Same-project operations always have full permissions.
 *
 * @task T4574
 * @epic T4540
 */
import { type NexusPermissionSetParams } from '@cleocode/contracts';
import { type EngineResult } from '../engine-result.js';
import { type NexusPermissionLevel } from './registry.js';
export interface PermissionCheckResult {
    project: string;
    required: NexusPermissionLevel;
    granted: NexusPermissionLevel;
    allowed: boolean;
}
/**
 * Convert a permission string to its numeric level.
 * Returns 0 for invalid/unknown permissions.
 */
export declare function permissionLevel(permission: string): number;
/**
 * Get the permission level for a registered project.
 * Returns 'read' as default if the project has no explicit permission.
 */
export declare function getPermission(nameOrHash: string): Promise<NexusPermissionLevel>;
/**
 * Check if a project has sufficient permissions (non-throwing).
 * Uses hierarchical comparison: execute >= write >= read.
 *
 * @returns true if the granted permission meets or exceeds the required level.
 */
export declare function checkPermission(nameOrHash: string, required: NexusPermissionLevel): Promise<boolean>;
/**
 * Require a permission level or throw CleoError.
 * Used as a guard at the start of cross-project operations.
 */
export declare function requirePermission(nameOrHash: string, required: NexusPermissionLevel, operationName?: string): Promise<void>;
/**
 * Full permission check returning a structured result.
 */
export declare function checkPermissionDetail(nameOrHash: string, required: NexusPermissionLevel): Promise<PermissionCheckResult>;
/**
 * Set the permission level for a project.
 * Validates the permission value and updates the registry.
 * @task T4574
 */
export declare function setPermission(_projectRoot: string, params: NexusPermissionSetParams): Promise<void>;
/** @deprecated Use `setPermission(projectRoot, params)` — ADR-057 D1 */
export declare function setPermission(nameOrHash: string, permission: NexusPermissionLevel): Promise<void>;
/** Convenience: check read access. */
export declare function canRead(nameOrHash: string): Promise<boolean>;
/** Convenience: check write access. */
export declare function canWrite(nameOrHash: string): Promise<boolean>;
/** Convenience: check execute access. */
export declare function canExecute(nameOrHash: string): Promise<boolean>;
/**
 * Set permission level for a project (EngineResult wrapper).
 *
 * @param name  - Project name or hash.
 * @param level - Permission level to set.
 * @task T1569
 */
export declare function nexusSetPermission(name: string, level: NexusPermissionLevel): Promise<EngineResult<{
    message: string;
}>>;
//# sourceMappingURL=permissions.d.ts.map