import type { Database as DatabaseType } from 'better-sqlite3';
import type { Capability, LimitsConfig, TeepeeConfig, AgentAccessProfile } from './config.js';
/**
 * Check if a user can tag a specific agent, optionally scoped to a topic.
 *
 * Rules (deny-by-default, deny wins):
 * 1. user must exist and be active
 * 2. user.role is normalized only for legacy `user -> collaborator`
 * 3. roles[role][agent] grants the effective profile
 * 4. missing role or missing agent mapping denies access
 */
export declare function canTag(db: DatabaseType, email: string, agentName: string, _topicId: number | null, config: TeepeeConfig): boolean;
export declare function resolveUserAgentProfile(db: DatabaseType, email: string, agentName: string, config: TeepeeConfig): AgentAccessProfile | null;
export declare function resolveUserRole(db: DatabaseType, email: string): string | null;
export declare function userHasCapability(db: DatabaseType, email: string, capability: Capability, config: TeepeeConfig): boolean;
/**
 * Check rate limit for a user.
 */
export declare function checkRateLimit(db: DatabaseType, email: string, limits: LimitsConfig): boolean;
/**
 * Filter a list of agent names by permission and rate limit.
 * Returns only the agents the user is allowed to tag.
 */
export declare function filterAllowedAgents(db: DatabaseType, email: string, agentNames: string[], topicId: number, limits: LimitsConfig, config: TeepeeConfig): {
    allowed: string[];
    denied: string[];
    rateLimited: boolean;
    profiles: Record<string, AgentAccessProfile>;
};
//# sourceMappingURL=permissions.d.ts.map