import type { Role } from "@slackwsh/contracts";
/**
 * Central authorisation module (§4.5): "Authorisation is centralised in one
 * module — core/policy.can(actor, action, resource). Controllers and socket
 * handlers call it; they never re-implement checks."
 *
 * The full roles × actions × resources permission matrix is a §8.1 spec
 * deliverable owed before Phase 2 opens. This is the MVP subset needed for
 * Phase 1 (workspace/channel/membership actions) — extend the ACTION_TABLE,
 * not the call sites, as new resource types are added.
 */
export type Action = "workspace:read" | "workspace:update_settings" | "workspace:delete" | "member:invite" | "member:remove" | "member:change_role" | "channel:create" | "channel:read" | "channel:update" | "channel:archive" | "channel:post" | "message:edit_own" | "message:edit_any" | "message:delete_own" | "message:delete_any" | "message:pin" | "task:create" | "task:read" | "task:update" | "task:assign" | "task:update_status" | "task:delete" | "event:create" | "event:read" | "event:update" | "event:invite" | "event:rsvp" | "event:delete" | "call:start" | "call:read" | "call:join" | "call:end";
export interface Actor {
    userId: string | number;
    role: Role;
}
export interface ResourceContext {
    /** Present when the check concerns a specific message/channel author. */
    isOwnResource?: boolean;
    /** True when the actor is a single-channel guest scoped outside this channel. */
    isOutsideGuestScope?: boolean;
}
export declare function can(actor: Actor, action: Action, ctx?: ResourceContext): boolean;
//# sourceMappingURL=policy.d.ts.map