import { TableSchema, ActorPermission } from '../schema/types';
/**
 * Storage-agnostic version of SheetAdapter's context — enough to decide access and, for
 * non-admin schemas, resolve a tenant-scoping key. For SheetAdapter, actorSheetId/targetSheetId
 * are real spreadsheet IDs; for SQL adapters (Phase 16.2) they're opaque tenant_id values.
 */
export interface AccessControlContext {
    role: string;
    targetActor?: string;
    actorSheetId?: string;
    targetSheetId?: string;
}
/**
 * Cross-actor permission matrix enforcement — extracted verbatim from SheetAdapter's former
 * private hasPermission() (Phase 16.3) so a non-Sheets DatabaseAdapter enforces identical
 * semantics instead of reimplementing this branching logic.
 */
export declare function hasPermission(schema: Pick<TableSchema, 'actor' | 'name'>, context: AccessControlContext | undefined, permissions: Record<string, ActorPermission> | undefined): boolean;
/**
 * Resolves the tenant-scoping key for a non-admin schema — extracted verbatim from
 * SheetAdapter's former private resolveSpreadsheetId() minus the admin branch (Phase 16.3).
 * Callers handle schema.actor === 'admin' themselves: "admin" means a fixed global store for
 * SheetAdapter (adminSheetId) but "no tenant filter at all" for SQL adapters, so there's no
 * single generic admin behavior to encode here.
 */
export declare function resolveNonAdminTenantKey(schema: Pick<TableSchema, 'actor'>, context: AccessControlContext | undefined): string;
//# sourceMappingURL=accessControl.d.ts.map