import type { EntityRef, PermissionKey } from '@substrat-run/contracts';
/** Added to both scope schemas and their on-wake upgrade path. */
export declare const GRANT_CHILDREN_INDEX_DDL = "CREATE INDEX IF NOT EXISTS _substrat_tuples_object_relation_subject ON _substrat_tuples (object, relation, subject)";
/** Ids can repeat across pages on multi-parent paths: only their union is complete. */
export type GrantedEntityIdsMayRepeatPage = {
    kind: 'ids';
    ids: string[];
    nextCursor: string | null;
};
export type GrantedEntitiesPage = {
    kind: 'all';
} | {
    kind: 'incomplete';
    reason: 'capability' | 'checker';
} | GrantedEntityIdsMayRepeatPage;
export interface GrantWalkRow {
    subject: string;
    object: string;
    expires_at: string | null;
    revoked_at: string | null;
}
export interface GrantWalkStore {
    /** The next grant for one subject, from the tuple primary key. */
    nextGrant(subject: string, relation: string, after: string): GrantWalkRow | undefined;
    /** The next reverse parent edge, from GRANT_CHILDREN_INDEX_DDL. */
    nextChild(parent: string, after: string): GrantWalkRow | undefined;
}
/**
 * Depth-first over grant roots and reverse parent edges. A cursor stores only the current
 * path (at most five refs), so neither graph width nor total result count grows it. A
 * multi-parent graph can produce the same id on different pages; consumers combine pages
 * as a set. Every id is rechecked by the caller before it leaves the kernel.
 */
export declare function walkGrantedEntities(store: GrantWalkStore, subjects: readonly string[], permission: PermissionKey, entityType: string, now: string, check: (entity: EntityRef) => Promise<boolean>, options?: {
    limit?: number;
    cursor?: string;
    workBudget?: number;
}): Promise<GrantedEntityIdsMayRepeatPage>;
//# sourceMappingURL=grant-scoped-read.d.ts.map