import { type DbExec } from "../db/client.js";
import type { OrgRole } from "../org/types.js";
export declare class McpCredentialIssuanceError extends Error {
    /**
     * `not-member`: the owner lacks the live membership or role the credential
     * needs, or holds an address an email change retired.
     */
    readonly reason: "not-member" | "unavailable";
    constructor(
    /**
     * `not-member`: the owner lacks the live membership or role the credential
     * needs, or holds an address an email change retired.
     */
    reason: "not-member" | "unavailable", options?: ErrorOptions);
}
export declare function withMcpCredentialIssuance<T>(input: {
    email: string;
    orgId?: string | null;
    requestOrigin?: string;
    kind?: "personal" | "service";
    /** Roles allowed to issue, rechecked under the membership lock. */
    roles?: readonly OrgRole[];
}, run: (tx: DbExec) => Promise<T>): Promise<T>;