/**
 * Cell view + edit + manage authorization helpers.
 *
 * Pure functions over `(auth, cell, grants)`. No DB I/O; the caller is
 * responsible for loading the cell row and the cell's grant list out-of-
 * band, then handing both to the predicate.
 *
 * Unauthenticated callers pass `null` for `auth` — public pages can
 * resolve `cell.visibility === 'public'` cells without a session, and
 * that branch is the only path that admits them. Callers may pass `null`
 * for `grants` in that case (and any case where they know they don't
 * need to consider grants); `grant_admits` short-circuits on null.
 *
 * Three tiers:
 *
 * - `can_view_cell` — admin / public / owner / any `viewer`+ grant.
 * - `can_edit_cell` — admin / owner / `editor` grant. NULL `created_by`
 *   is admin-only (system-origin defense-in-depth).
 * - `can_manage_cell` — admin / owner only. Not delegable, not a grant
 *   level. Gates the manage tier: `visibility` writes and all grant
 *   management (`cell_grant_create` / `_list` / `_revoke`).
 *
 * Grant-admit branches: per-`actor_id` grants admit the matching
 * actor; `(role, scope_id?)` grants admit any holder of an active
 * role_grant matching those literals (`scope_id IS NULL` admits any-scope
 * role_grant). The grant's `level` (`viewer` / `editor`) gates which
 * predicate it satisfies.
 *
 * @module
 */
import { type RequestContext } from './request_context.js';
import type { CellRow } from '../db/cell_queries.js';
import type { CellGrantRow } from '../db/cell_grant_queries.js';
/**
 * View authorization for a cell.
 *
 * - Admin: always allowed.
 * - `cell.visibility === 'public'`: allowed for everyone, including
 *   unauthenticated callers (e.g. a public landing cell).
 * - Owner (`cell.created_by === auth.actor.id`): allowed.
 * - Any active grant on the cell admits the caller (actor-shaped:
 *   match on actor_id; role-shaped: match on `(role, scope_id?)`
 *   against an active role_grant).
 * - Otherwise: false.
 *
 * @param auth - request context, or `null` for unauthenticated callers
 * @param cell - the cell row
 * @param grants - the cell's grant list, or `null` to skip the grant branch
 * @returns whether the caller may view the cell
 */
export declare const can_view_cell: (auth: RequestContext | null, cell: CellRow, grants: ReadonlyArray<CellGrantRow> | null) => boolean;
/**
 * Edit authorization for a cell.
 *
 * Unauthenticated callers can never edit. Admin always allowed.
 *
 * IMPORTANT: the `cell.created_by === null` branch is **explicit
 * defense-in-depth**. NULL `created_by` means system origin (well-known
 * cells seeded by migration, future daemon/agent cells). Non-admin edits
 * MUST be denied — editor-level grants do NOT bypass this guard,
 * because system cells are policy-controlled at admin level. Do NOT
 * collapse into a single equality check that would silently return
 * `false` for NULL via JS equality semantics — the explicit branch
 * survives refactors and reads as a load-bearing security property.
 *
 * @param auth - request context, or `null` for unauthenticated callers
 * @param cell - the cell row
 * @param grants - the cell's grant list, or `null` to skip the grant branch
 * @returns whether the caller may edit the cell
 */
export declare const can_edit_cell: (auth: RequestContext | null, cell: CellRow, grants: ReadonlyArray<CellGrantRow> | null) => boolean;
/**
 * Manage authorization for a cell — `admin || owner`.
 *
 * The implicit tier above editor: gates `visibility` writes and all grant
 * management (`cell_grant_create` / `_list` / `_revoke`). NOT delegable and
 * NOT a grant level — an editor-grant holder is never a manager. Grants are
 * not consulted.
 *
 * NULL `created_by` (system origin) has no owner, so manage falls to
 * admin only — the explicit NULL guard lives in `is_owner`.
 *
 * @param auth - request context, or `null` for unauthenticated callers
 * @param cell - the cell row
 * @returns whether the caller is in the manage tier for the cell
 */
export declare const can_manage_cell: (auth: RequestContext | null, cell: CellRow) => boolean;
//# sourceMappingURL=cell_authorize.d.ts.map