import { type VerifyTokenHook } from '@kokuin/capability';
import { type DIDMethodResolver } from '@kokuin/token';
export type AuthorizeActionParams = {
    action: string;
    /** Resource specificity tiers, most-specific first. */
    resources: Array<string>;
    callerDID: string;
    ownerDID: string;
    /** Independent delegation chains; any chain proving the request over any tier authorizes it. */
    caps: Array<Array<string>>;
    authenticated: boolean;
    atTime: number;
    revocationChecker: VerifyTokenHook;
    controllerResolver?: DIDMethodResolver;
    rejectUnboundResource?: (grantedRes: string) => boolean;
};
/**
 * Generic capability-backed action authorizer: fails closed unless authenticated, then shortcuts
 * a caller acting on their own behalf, else walks every resource tier against every delegation
 * chain looking for one that proves the request.
 */
export declare function authorizeAction(params: AuthorizeActionParams): Promise<boolean>;