/**
 * Scope semantics (SPEC.md §3) — requested ∩ allowed intersection,
 * revocation, stored-scope extraction, write-path authorization, and the
 * §3.5 scope digest.
 */
import { type RowValue, type ScopeMap } from '@syncular/core';
import type { CompiledTable } from './schema.js';
export type StoredScopes = Record<string, string>;
/** Outcome of resolving the host's allowed scopes once per request (§3.4). */
export type ResolvedScopes = {
    readonly ok: true;
    readonly allowed: ScopeMap;
} | {
    readonly ok: false;
};
export type EffectiveOutcome = {
    readonly status: 'active';
    readonly effective: ScopeMap;
} | {
    readonly status: 'revoked';
};
/**
 * Effective = requested ∩ allowed per §3.2 rules 4–5. Inputs are assumed
 * key-validated (requested keys declared, no `'*'` requested values).
 */
export declare function computeEffective(requested: ScopeMap, resolved: ResolvedScopes): EffectiveOutcome;
/** Render a stored scope column value; `undefined` means missing/empty. */
export declare function renderScopeValue(value: RowValue | undefined): string | undefined;
/**
 * Extract the stored scopes (§3.1) from a decoded row. Returns the missing
 * variable name when a declared scope column is absent or empty.
 */
export declare function storedScopesForRow(table: CompiledTable, values: readonly RowValue[]): {
    scopes: StoredScopes;
} | {
    missing: string;
};
/**
 * Write-path authorization (§3.4 steps 2–3): every declared variable's
 * stored value must be present and allowed (or the allowed list holds
 * `'*'`). All declared keys are required — there is no partial pass.
 */
export declare function authorizeWrite(table: CompiledTable, rowScopes: StoredScopes, resolved: ResolvedScopes): boolean;
/** Does a change's stored scopes match the effective scopes (§3.2)? */
export declare function matchesEffective(storedScopes: StoredScopes, effective: ScopeMap): boolean;
export declare function sha256Hex(bytes: Uint8Array): Promise<string>;
/** §3.5: SHA-256 over the canonical JSON of the effective-scope map. */
export declare function scopeDigest(effective: ScopeMap): Promise<string>;