export type CredentialTargetResult = {
    ok: true;
    target: string;
    isCrossIdentity: boolean;
} | {
    ok: false;
    error: string;
};
/**
 * Resolve which admin row a credential tool may write.
 *
 * - No explicit `userId`: writes the verified caller's own row. If there is no
 *   verified caller identity, the call ERRORS (never a silent ambient fallback).
 * - Explicit `userId` equal to the caller: a self write, no confirm needed.
 * - Explicit `userId` differing from the caller (or with no caller to compare):
 *   a cross-identity write, allowed only with `confirm === true`.
 */
export declare function resolveCredentialTarget(input: {
    explicitUserId?: string;
    callerUserId?: string;
    confirm?: boolean;
}): CredentialTargetResult;
//# sourceMappingURL=credential-identity.d.ts.map