import { type Condition, type ConditionBuilder } from "@executor-js/fumadb/query";
import type { AnyColumn, AnyTable } from "@executor-js/fumadb/schema";
export declare const executorOwnerPolicyName = "executor.owner";
/** Tenant-shared tables (the integration catalog) — partitioned by `tenant` only. */
export declare const executorTenantPolicyName = "executor.tenant";
/** Truly global tables (the blob store) — isolation carried in the row namespace. */
export declare const executorUnscopedPolicyName = "executor.unscoped";
/** Sentinel `subject` value for org-owned rows. */
export declare const ORG_SUBJECT = "";
export interface ExecutorOwnerPolicyContext {
    readonly tenant: string;
    /** The acting member, or null for a pure-org executor (no `owner:"user"`
     *  reads/writes are allowed when null). */
    readonly subject: string | null;
}
type AnyConditionBuilder = ConditionBuilder<Record<string, AnyColumn>>;
/** The rows the bound `{ tenant, subject }` may see/mutate: org rows in the
 *  tenant, plus this subject's own user rows. */
export declare const ownerVisibilityCondition: (builder: AnyConditionBuilder, context: ExecutorOwnerPolicyContext) => Condition | boolean;
/** Assert a create/upsert writes a row inside the bound partition. */
export declare const assertOwnerWritable: (tableName: string, values: Record<string, unknown>, context: ExecutorOwnerPolicyContext | undefined) => void;
/** Assert a patch (`set`) doesn't move a row out of the bound partition. Only
 *  validates the partition columns that are actually being written. */
export declare const assertOwnerPatch: (tableName: string, patch: Record<string, unknown> | undefined, context: ExecutorOwnerPolicyContext | undefined) => void;
export declare const hasExecutorOwnerPolicy: (table: AnyTable) => boolean;
export declare function assertExecutorOwnerPolicyTable(table: AnyTable, tableKey?: string): void;
export {};
//# sourceMappingURL=owner-policy.d.ts.map