import type { IncomingMessage, ServerResponse } from 'node:http';
export type MemberScope = {
    kind: 'admin';
} | {
    kind: 'user';
    userId: string;
    threadIds: string[];
    threadKeys: string[];
} | {
    kind: 'none';
};
export declare function webThreadKey(threadId: string): string;
export declare function resolveMemberScope(req: IncomingMessage): Promise<MemberScope>;
export declare function sendForbidden(res: ServerResponse, message?: string): void;
/** List/read APIs: empty result rather than 403 when the actor has no account. */
export declare function emptyMemberScope(scope: MemberScope): scope is {
    kind: 'none';
};
/**
 * Owner key for Portal-owned rows (scheduled tasks, "mine" job lists).
 * Logged-in accounts — including admins — are scoped to their `usr_*` id
 * so one person's automations never appear in another person's list.
 * Loopback / auth-off without a user id fall back to the stable actor
 * string (`web:loopback` / `web:auth-off`).
 */
export declare function requestOwnerId(req: IncomingMessage): string | undefined;
/** `usr_*` rows must not mix with legacy ownerless (`creator_id = ''`) rows. */
export declare function ownerIdIsAccount(ownerId: string): boolean;
export declare function scopeOwnsThread(scope: MemberScope, threadId: string, platform?: string): boolean;
export declare function scopeOwnsThreadKey(scope: MemberScope, threadKey: string): boolean;
export declare function jobVisibleToScope(job: {
    creator_id?: string | null;
    thread_key?: string | null;
}, scope: MemberScope): boolean;
/**
 * Portal / loop mutations: the live composer thread may be an empty shell
 * that listUserWebSessions skips. Missing session + web platform → allow
 * (brand-new chat). A session owned by someone else → deny.
 */
export declare function webThreadAccessible(scope: MemberScope, threadId: string, platform?: string, channelId?: string): Promise<boolean>;
export declare function requireWebThreadAccess(req: IncomingMessage, res: ServerResponse, threadId: string, platform?: string, channelId?: string): Promise<boolean>;
//# sourceMappingURL=member-scope.d.ts.map