/**
 * RBAC enforcement helper for CLI commands.
 *
 * Authenticates the current user via AEGIS_USER_TOKEN and checks
 * whether they have the required permission.
 */
import type { getDb } from '../db.js';
import type { Permission } from '../user/index.js';
/**
 * Authenticate the current user via AEGIS_USER_TOKEN and check permission.
 *
 * Always enforced once users exist. If no users have been created yet
 * (bootstrap mode), all commands are allowed — `aegis init` creates the
 * first admin user.
 *
 * Returns true if allowed. Calls process.exit(1) if denied.
 */
export declare function requireUserAuth(db: ReturnType<typeof getDb>, derivedKey: Buffer, permission: Permission): boolean;
//# sourceMappingURL=auth.d.ts.map