/**
 * Framework-free per-folder access control helpers.
 *
 * These functions decide what a given user can see or write in the workspace.
 * They take `AuthUser | undefined` directly (not a Fastify request) so they
 * can be reused across transports — HTTP (/api/*), MCP HTTP (/mcp), and
 * MCP stdio all share the same rules.
 *
 * Rule summary:
 * - `user === undefined` means "no identified user". On the **web** this is
 *   API-key / open-mode (full access). On **MCP** the caller site rejects
 *   unidentified requests before reaching these helpers, so every MCP tool
 *   can assume a concrete user and `undefined` is never passed in.
 * - A user can see a folder if they are an explicit member (folder_access row),
 *   or if they are the workspace owner AND the folder has more than one member
 *   (shared folders are visible to owners, solo folders stay private).
 * - A user can write to a folder if they are a folder member (role = admin|editor),
 *   or if they are the workspace owner on a shared folder.
 * - A folder with `personal: true` is only visible/writable to its owner,
 *   regardless of folder_access grants or workspace ownership. Stale grants
 *   (from an older sharing attempt or test setup) cannot leak a user's
 *   private notes to another account.
 * - **Owner admin escalation**: workspace owners can lift the personal-
 *   folder restriction by passing `{ includePrivate: true }` to these
 *   helpers. The flag is enforced as owner-only inside the helpers — non-
 *   owners passing it get no extra access. The owner-only CLI (`clone` /
 *   `pull` / `push`) sends it unconditionally so the owner always sees every
 *   folder; web / API surfaces opt in via the `?include_private=1` query
 *   param on `/api/repos` or the `X-Studiograph-Include-Private: 1` header
 *   for git transport. Used for migrations, audits, and offboarding.
 */
import type { WorkspaceManager } from '../core/workspace-manager.js';
import type { RepoConfig } from '../core/types.js';
import { type AuthService, type AuthUser } from './auth-service.js';
/** True if the folder is workspace-wide (the reserved shared asset store).
 *  Every authenticated member gets read + write (upload) without a
 *  folder_access grant. This does NOT grant folder-admin (rename/delete the
 *  folder) or per-asset deletion — those stay owner/uploader-scoped. A
 *  workspace-wide folder must never also be `personal`. */
export declare function isWorkspaceWide(repoName: string, workspaceManager: WorkspaceManager): boolean;
/**
 * Options accepted by the access helpers. `includePrivate` is an owner-
 * gated admin escalation: workspace owners can opt into seeing every
 * folder (including other users' personal ones) for migration / audit /
 * offboarding work. Default operations stay scoped so the owner's daily
 * workflow isn't cluttered with members' private content.
 */
export interface AccessOptions {
    /** Owner-only override: when true AND caller is a workspace owner, the
     *  personal-folder restriction is lifted. No-op for non-owners. */
    includePrivate?: boolean;
}
/**
 * Return the list of repos the user can access (content visibility).
 * Unidentified caller (undefined) → full access, preserves legacy
 * web / API-key behavior.
 */
export declare function getAccessibleRepos(user: AuthUser | undefined, workspaceManager: WorkspaceManager, authService: AuthService, opts?: AccessOptions): RepoConfig[];
/** True if the user may read the given folder's contents. */
export declare function hasRepoAccess(user: AuthUser | undefined, repoName: string, workspaceManager: WorkspaceManager, authService: AuthService, opts?: AccessOptions): boolean;
/** True if the user is a folder admin on the given repo, OR a workspace
 *  owner on a shared folder (>1 member). Solo/private folders require
 *  actual folder-admin membership — workspace ownership alone does not
 *  let owners rename, delete, or push members into a private folder. */
export declare function isFolderAdminOrOwner(user: AuthUser | undefined, repoName: string, workspaceManager: WorkspaceManager, authService: AuthService): boolean;
/**
 * True if the user may write (create/update/delete entities) in the given folder.
 * Membership grants write access regardless of role (both 'admin' and 'editor'
 * can edit), and workspace owners can write to shared folders.
 */
export declare function canWriteRepo(user: AuthUser | undefined, repoName: string, workspaceManager: WorkspaceManager, authService: AuthService): boolean;
/**
 * Build a set of all entity IDs visible to the user across their accessible
 * folders. Returns null when the caller is unidentified (no filtering needed —
 * `filterWikilinks` treats null as "no-op").
 */
export declare function getAccessibleEntityIds(user: AuthUser | undefined, workspaceManager: WorkspaceManager, authService: AuthService): Set<string> | null;
/** Filter a wikilink list to only entities the caller can access. */
export declare function filterWikilinks(wikilinks: string[], accessibleIds: Set<string> | null): string[];
