import type { ToolContext, ToolDefinition } from '../../../types/index.js';
import type { TeamRole } from '../../../database/core/interfaces.js';
/**
 * Resolves the identity of the user calling the tool.
 * Prefers OAuth claims, falls back to an explicit 'author' parameter,
 * and ultimately to the TEAM_AUTHOR environment variable.
 */
export declare function getCallerIdentity(_params?: Record<string, unknown>): string;
/**
 * Enforces role-based access control for team tools.
 *
 * @throws {AuthorizationError} if the user does not have the required role or is denied.
 */
export declare function enforceTeamRbac(context: ToolContext, author: string, requiredRole?: TeamRole): void;
/**
 * Enforces ownership rules for mutating entries.
 * Admins can modify any entry, but members can only modify their own.
 *
 * @throws {AuthorizationError} if a non-admin tries to modify someone else's entry.
 */
export declare function enforceOwnership(author: string, resourceAuthor: string, role: TeamRole | null): void;
/**
 * Wraps tool handlers to enforce Team RBAC automatically.
 * Automatically infers 'viewer' for read-only tools, and uses defaultRequiredRole for others.
 * Tools explicitly requiring admin scope will demand 'admin'.
 */
export declare function wrapWithRbac(context: ToolContext, tools: ToolDefinition[], defaultRequiredRole?: TeamRole): ToolDefinition[];
//# sourceMappingURL=rbac.d.ts.map