/**
 * Task 1557 — decide which identity a profile op (profile-read/update/delete)
 * attributes to, given the already-resolved facts. Pure: no DB, no env.
 *
 * - Cross-account (a house session that set targetAccountId): attribute to the
 *   target account's owner; reject if the target has no owner on record.
 * - Own-account, caller is a registered admin of THIS account (their AdminUser
 *   home account equals the session account): attribute to the caller. This is
 *   the owner-is-speaker path and the genuine second-admin path.
 * - Own-account, caller is a FOREIGN operator (a non-null home account that
 *   differs from the session account — a house operator working inside a
 *   client's sub-account): attribute to the session account's owner; reject
 *   loudly if that account has no owner on record. A null home (missing or
 *   legacy-unstamped AdminUser node) is NOT treated as foreign; it attributes
 *   to the caller, preserving self-attribution on uncertainty.
 */
export type ProfileAttribution = {
    kind: "caller";
    userId: string;
} | {
    kind: "owner";
    userId: string;
} | {
    kind: "reject";
    reason: "no-caller" | "no-owner";
};
export declare function classifyProfileIdentity(input: {
    crossAccount: boolean;
    resolvedAccountId: string;
    callerUserId: string | undefined;
    callerHomeAccountId: string | null;
    ownerUserId: string | null;
}): ProfileAttribution;
//# sourceMappingURL=profile-identity.d.ts.map