import type { AuditReadScope, AuditTrail } from "./store.js";
export declare class AuditAccessError extends Error {
    readonly statusCode = 403;
    constructor(message: string);
}
/**
 * Build the read scope for `ctx`. Owners and admins of the active org also
 * read its `admins` rows. `organization` reads only the org's shared trail and
 * is refused for everyone else with an {@link AuditAccessError}.
 */
export declare function resolveAuditReadScope(ctx: {
    userEmail?: string;
    orgId?: string | null;
} | undefined, trail?: AuditTrail): Promise<AuditReadScope>;