export declare const AUTH_TABLE_NAMES: Set<string>;
export type AccessUser = {
    id: string;
    email: string;
    name?: string;
    role?: string;
};
export type AccessContext = {
    user: AccessUser | null;
    request: Request;
    row?: Record<string, unknown>;
    body?: Record<string, unknown>;
    session?: {
        activeOrganizationId: string | null;
    } | null;
};
export type OperationRule = 'public' | 'authenticated' | 'owner' | 'deny' | ((ctx: AccessContext) => boolean | Promise<boolean>);
export type ScopeMap = Record<string, string | string[]>;
export type ScopeResolver = (ctx: AccessContext) => ScopeMap;
export type CrudOperation = 'list' | 'get' | 'create' | 'update' | 'delete';
export type SortOrder = 'asc' | 'desc';
export type DefaultSort = {
    column: string;
    order: SortOrder;
};
export type TableAccessInput = {
    crud?: boolean;
    /** Opt the BetterAuth `user` table into auto-CRUD (read profiles, owner-update image). */
    exposeAuthTable?: boolean;
    ownerColumn?: string;
    list?: OperationRule;
    get?: OperationRule;
    create?: OperationRule;
    update?: OperationRule;
    delete?: OperationRule;
    /** Explicit write allowlist. Entries override matching system-readonly
     * defaults such as `updatedAt`; `id` remains immutable on update. */
    writableColumns?: string[];
    readonlyColumns?: string[];
    /** Columns matched by `?q=` on list — opt-in; omitted columns are never searched. */
    searchableColumns?: string[];
    /** Columns filterable via flat `?column=value` query params. */
    filterableColumns?: string[];
    /** Columns allowed in `?sort=`. Defaults to `['id']`. */
    sortableColumns?: string[];
    /** Default list ordering when `?sort` is omitted. Defaults to `{ column: 'id', order: 'desc' }`. */
    defaultSort?: DefaultSort;
    scope?: {
        read?: ScopeResolver;
        write?: ScopeResolver;
    };
};
export type ResolvedTableAccess = {
    tableKey: string;
    tableName: string;
    enabled: boolean;
    ownerColumn?: string;
    list: OperationRule;
    get: OperationRule;
    create: OperationRule;
    update: OperationRule;
    delete: OperationRule;
    writableColumns?: string[];
    readonlyColumns: string[];
    searchableColumns?: string[];
    filterableColumns: string[];
    sortableColumns: string[];
    defaultSort: DefaultSort;
    readScope?: ScopeResolver;
    writeScope?: ScopeResolver;
};
export type ResolvedAccess = Map<string, ResolvedTableAccess>;
/**
 * Look up a table's resolved access by its physical table name.
 *
 * `ResolvedAccess` is keyed by schema export name, not table name, so every
 * consumer that starts from a physical name needs this scan. It lives here so
 * CRUD, realtime, and route validation cannot drift apart on which tables they
 * consider enabled.
 */
export declare function tableEntryForName(access: ResolvedAccess, tableName: string): ResolvedTableAccess | undefined;
export declare function validateAndResolveAccess<TSchema extends Record<string, unknown>>(schema: TSchema, accessInput?: Record<string, TableAccessInput>): ResolvedAccess;
export declare function defineAccess<TSchema extends Record<string, unknown>, const TRules extends Record<string, TableAccessInput>>(schema: TSchema, rules: TRules): TRules;
export declare function rowMatchesScope(row: Record<string, unknown>, scope: ScopeMap): boolean;
export declare function stampScope(values: Record<string, unknown>, scope: ScopeMap): Record<string, unknown>;
export declare function checkAccessSync(rule: Exclude<OperationRule, (ctx: AccessContext) => boolean | Promise<boolean>>, ctx: AccessContext, ownerColumn?: string): {
    allowed: boolean;
};
export declare function checkAccess(rule: OperationRule, ctx: AccessContext, ownerColumn?: string): Promise<{
    allowed: boolean;
    status: 401 | 403;
}>;
export declare function sanitizeWriteBody(body: Record<string, unknown>, access: ResolvedTableAccess, mode: 'create' | 'update', userId: string | null): Record<string, unknown>;
export type AuthSessionResolver = {
    api: {
        getSession: (opts: {
            headers: Headers;
        }) => Promise<{
            user: {
                id: string;
                email: string;
                name?: string;
                role?: string;
            } | null;
            session?: {
                activeOrganizationId?: string | null;
            } | null;
        } | null>;
    };
};
export declare function resolveAccessUser(auth: AuthSessionResolver | undefined, headers: Headers): Promise<AccessUser | null>;
export declare function resolveSession(auth: AuthSessionResolver | undefined, headers: Headers): Promise<{
    user: AccessUser | null;
    activeOrganizationId: string | null;
}>;
//# sourceMappingURL=access.d.ts.map