import type { ActionRunContext } from "../action.js";
import { type ShareRole } from "../sharing/schema.js";
export type ActionAccessScope = "app" | "org" | "resource";
export type ActionResourceAccessLevel = ShareRole | "owner";
export interface ActionResourceAccess {
    type: string;
    idFrom: string;
    level?: ActionResourceAccessLevel;
}
interface ActionAccessConfigBase {
    scope?: Exclude<ActionAccessScope, "resource">;
    permission?: string;
    resource?: ActionResourceAccess;
}
export type ActionAccessConfig = ActionAccessConfigBase | (Omit<ActionAccessConfigBase, "scope" | "resource"> & {
    scope: "resource";
    resource: ActionResourceAccess;
});
export interface ActionAccessDecision {
    allowed: boolean;
    reason: string;
    appId?: string;
    permission?: string;
    roles?: string[];
    resourceRole?: ActionResourceAccessLevel;
}
export interface ActionAccessTarget {
    appId?: string;
    userEmail?: string | null;
    orgId?: string | null;
}
export declare function checkAction(config: ActionAccessConfig | undefined, args: unknown, ctx?: ActionRunContext, target?: ActionAccessTarget): Promise<ActionAccessDecision>;
export declare function assertActionAccess(config: ActionAccessConfig | undefined, args: unknown, ctx?: ActionRunContext): Promise<ActionAccessDecision>;
export {};