import type { OrgRole } from "../../org/types.js";
export declare class ServiceTokenError extends Error {
    statusCode: number;
    constructor(message: string, statusCode: number);
}
/** Look up the caller's role in `orgId`, or null when not a member. */
export declare function getOrgRoleForEmail(orgId: string, email: string): Promise<OrgRole | null>;
export interface ServiceTokenCallerContext {
    email: string;
    orgId: string;
    role: OrgRole;
}
/**
 * Resolve and gate the caller for a service-token action. Throws
 * `ServiceTokenError` (401/400/403) on failure so the action route maps it to
 * the right HTTP status.
 */
export declare function requireServiceTokenCaller(params: {
    userEmail: string | undefined;
    orgId: string | null | undefined;
    /** 'manage' = mint/revoke (owner/admin only); 'read' = list (any member). */
    level: "manage" | "read";
}): Promise<ServiceTokenCallerContext>;
//# sourceMappingURL=service-token-access.d.ts.map