/**
 * #365 `org validate` findings for `policy.access: 'full'` roles — separate
 * from access-taint.ts (the untrusted-input/reachability checks) so each
 * stays under this project's file-size norms and is unit-testable on its
 * own. Called from `org-observe-config.ts`'s `validateAction` alongside
 * `gitEnforcementFindings` (role-sandbox.ts), which this deliberately
 * mirrors in shape (`{errors, warnings}`).
 */
import type { OrgDef } from './types.js';
/** Minimal shape of one role's raw (pre-zod, as-authored) JSON — enough to
 *  tell "the author wrote this key" from "the schema defaulted it", which is
 *  lost the moment `OrgDefSchema.parse` fills in `policy.git`'s default. */
interface RawRole {
    id?: unknown;
    policy?: Record<string, unknown>;
}
/** `errors`/`warnings` for every `policy.access: 'full'` role in `def`.
 *  `rawRoles` is `JSON.parse(orgFileText).roles` — the UNVALIDATED author
 *  JSON, before `OrgDefSchema.parse` applies `policy.git`'s default; pass it
 *  so "git below push, left unset" (fine — full access implies push) can be
 *  told apart from "git below push, explicitly authored" (a validation
 *  error: the config is misleading about its own enforcement). Omit it (a
 *  caller that only has the parsed `OrgDef`, e.g. a live-reload path) to
 *  skip that one check. */
export declare function accessValidationFindings(def: OrgDef, rawRoles?: RawRole[]): {
    errors: string[];
    warnings: string[];
};
export {};
//# sourceMappingURL=access-validate.d.ts.map