/**
 * Pure permission helpers — RBAC checks over a `PermissionMap`
 * (compatible with `<PermissionsMatrix>`).
 *
 * Hierarchy: `admin` ⊃ `write` ⊃ `read`.
 */
export type PermissionLevel = 'read' | 'write' | 'admin';
/** roleId → resourceId → levels granted */
export type PermissionMap = Record<string, Record<string, PermissionLevel[]>>;
export declare const PERMISSION_LEVELS: PermissionLevel[];
export declare const LEVEL_RANK: Record<PermissionLevel, number>;
/** True when `granted` covers `required` (admin implies write implies read). */
export declare function levelSatisfies(granted: PermissionLevel[] | readonly PermissionLevel[], required: PermissionLevel): boolean;
/** Unique levels sorted by rank ascending. */
export declare function mergeLevels(...lists: Array<PermissionLevel[] | readonly PermissionLevel[] | undefined>): PermissionLevel[];
export declare function getRoleLevels(map: PermissionMap, roleId: string, resource: string): PermissionLevel[];
/** Union of levels across all of the user's roles for a resource. */
export declare function getEffectiveLevels(map: PermissionMap, roles: string[] | readonly string[], resource: string): PermissionLevel[];
/**
 * Can the given roles perform `level` on `resource`?
 *
 * @example
 * ```ts
 * can(map, ['member'], 'projects', 'write') // true if member has write|admin on projects
 * ```
 */
export declare function can(map: PermissionMap, roles: string[] | readonly string[], resource: string, level?: PermissionLevel): boolean;
export declare function hasRole(roles: string[] | readonly string[], role: string): boolean;
export declare function hasAnyRole(roles: string[] | readonly string[], required: string[] | readonly string[]): boolean;
export declare function hasAllRoles(roles: string[] | readonly string[], required: string[] | readonly string[]): boolean;
export interface PermissionCheck {
    /** Resource id (e.g. `projects`) */
    resource?: string;
    /** Minimum level required (default `read`). Implies lower levels. */
    level?: PermissionLevel;
    /** Exact role */
    role?: string;
    /** At least one of these roles */
    anyRole?: string[];
    /** All of these roles */
    allRoles?: string[];
}
/**
 * Evaluate a declarative check against roles + map.
 * Resource checks and role checks are AND-ed when both are present.
 */
export declare function checkPermission(map: PermissionMap, roles: string[] | readonly string[], check: PermissionCheck): boolean;