import type { H3Event } from "h3";
import type { OrgContext, OrgRole } from "./types.js";
/**
 * The single way to read `org_members`, so no two call sites can pick opposite
 * defaults for the same failure. A transient database failure is NOT an answer
 * and propagates: a caller that turns it into "no memberships" silently drops
 * org scope, which hides every org-scoped credential behind a
 * permanent-sounding "not configured".
 *
 * `null` is every non-transient failure, not only the intended one (org tables
 * absent on a fresh install before migrations). A permanently unreadable table
 * — a role without SELECT, say — still reports as "no rows" here. Narrowing
 * that further means classifying "no database configured" as readable-absent,
 * which is load-bearing for CLI/script/test contexts that legitimately run
 * without a store; see `assertCredentialStoreReadable`.
 */
export declare function queryOrgMembers(query: {
    sql: string;
    args: unknown[];
}): Promise<Record<string, unknown>[] | null>;
/**
 * Resolve the current user's organization context from their session.
 *
 * - Honors the user's `active-org-id` setting, including an explicit Personal
 *   context represented by `{ orgId: null }`.
 * - Falls back to the user's first membership.
 * - When the authenticated user has zero memberships, provisions a default org
 *   named after the user ({name}'s workspace, falling back to the email
 *   local-part). Set `AUTO_CREATE_DEFAULT_ORG=0` to opt out.
 *
 * Per-request memoized on `event.context` — mirrors the `getSession`
 * pattern so multiple callers in the same request (e.g. ssr-handler +
 * a loader) share a single org_members round trip.
 */
export declare function getOrgContext(event: H3Event): Promise<OrgContext>;
/**
 * Resolve the active org ID for a given email — for non-HTTP contexts like
 * the integration webhook handler where we have an email but no event/session.
 * Picks the user's active-org-id setting if set, including explicit Personal,
 * otherwise the oldest membership.
 * Returns null if the user has no memberships.
 */
export declare function resolveOrgIdForEmail(email: string): Promise<string | null>;
/**
 * Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.
 * Shares the per-request membership lookup with `getOrgContext`, so the
 * session org backfill inside `getSession` and a later `getOrgContext` call
 * in the same request pay ONE org_members round trip, not two.
 */
export declare function resolveOrgIdForEmailViaEvent(event: H3Event, email: string): Promise<string | null>;
/**
 * Create a new organization and add the caller as a member with the given
 * role. Generates a per-org A2A secret for cross-app delegation and writes
 * the caller's `active-org-id` user-setting so the new org is immediately
 * active.
 *
 */
export declare function createOrganization(name: string, email: string, role?: OrgRole): Promise<{
    id: string;
    name: string;
    role: OrgRole;
    a2aSecret: string;
    createdAt: number;
}>;
/**
 * Look up the `allowed_domain` for an org by its ID.
 * Used when making outbound A2A calls so the JWT includes the
 * caller's org domain for cross-app org resolution.
 */
export declare function getOrgDomain(orgId: string): Promise<string | null>;
/**
 * Look up the org's A2A secret by org ID.
 * Used when making outbound A2A calls so the JWT is signed with the
 * org-specific secret rather than the global A2A_SECRET env var.
 */
export declare function getOrgA2ASecret(orgId: string): Promise<string | null>;
/**
 * Look up an org's A2A secret by its `allowed_domain`.
 * Used on the A2A receiving side: the caller's JWT includes `org_domain`,
 * and the receiver looks up which local org matches that domain to find
 * the secret used to verify the JWT signature.
 */
export declare function getA2ASecretByDomain(domain: string): Promise<string | null>;
/**
 * Resolve a local org by its `allowed_domain`.
 * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,
 * and the receiver looks up which local org matches that domain.
 */
export declare function resolveOrgByDomain(domain: string): Promise<{
    orgId: string;
    orgName: string;
} | null>;
//# sourceMappingURL=context.d.ts.map