/**
 * PermissionResolver, Focused responsibility: role and scope checks.
 *
 * Inspects a `ControlPlaneAuthSnapshot` to answer permission questions.
 * Callers that only need access control checks can use this directly
 * rather than traversing the full auth snapshot themselves.
 */
import type { ControlPlaneAuthSnapshot } from './control-plane-auth-snapshot.js';
export declare class PermissionResolver {
    #private;
    constructor(snapshot: ControlPlaneAuthSnapshot);
    /** Whether the current principal is authenticated. */
    get authenticated(): boolean;
    /** Whether the current principal has admin privileges. */
    get isAdmin(): boolean;
    /** The principal identifier (user/bot/service id), or null when anonymous. */
    get principalId(): string | null;
    /** The kind of the current principal. */
    get principalKind(): ControlPlaneAuthSnapshot['principalKind'];
    /** Return true when the principal holds the given role. */
    hasRole(role: string): boolean;
    /** Return true when the principal holds ALL of the given roles. */
    hasAllRoles(roles: readonly string[]): boolean;
    /** Return true when the principal holds ANY of the given roles. */
    hasAnyRole(roles: readonly string[]): boolean;
    /** Return true when the principal holds the given scope. */
    hasScope(scope: string): boolean;
    /** Return true when the principal holds ALL of the given scopes. */
    hasAllScopes(scopes: readonly string[]): boolean;
    /** Return true when the principal holds ANY of the given scopes. */
    hasAnyScope(scopes: readonly string[]): boolean;
    /** Expose the raw snapshot for direct inspection. */
    get snapshot(): ControlPlaneAuthSnapshot;
}
//# sourceMappingURL=permission-resolver.d.ts.map