import type { ActionRunContext } from "../action.js";
export interface AppRolesDescriptor<R extends string = string, P extends string = string> {
    appId: string;
    roles: readonly R[];
    defaultRole?: R;
    roleLabels?: Partial<Record<R, string>>;
    permissions?: Partial<Record<P, readonly R[]>>;
    permissionLabels?: Partial<Record<P, string>>;
    label?: string;
}
export type AppRoleLookup<R extends string = string> = {
    status: "assigned";
    roles: R[];
    orgId: string;
    orgRole?: string;
} | {
    status: "unassigned";
    orgId: string;
    orgRole?: string;
    hasAssignments?: boolean;
} | {
    status: "not-a-member";
    orgId: string;
} | {
    status: "no-identity";
} | {
    status: "no-org";
};
export interface AppRoleCaller {
    userEmail?: string | null;
    orgId?: string | null;
}
export interface AppPermissionPolicy<R extends string> {
    unassignedRole?: R;
    allowOrgAdmins?: boolean;
}
export interface AppAuthorizationContext {
    appId: string;
    roles: string[];
    permissions: Record<string, string[]>;
}
export interface AppRoles<R extends string = string, P extends string = string> {
    descriptor: AppRolesDescriptor<R, P>;
    appId: string;
    roles: readonly R[];
    resolve: (caller?: AppRoleCaller) => Promise<AppRoleLookup<R>>;
    assertAny: (allowed: readonly R[], caller?: AppRoleCaller) => Promise<R>;
    requireAny: (...allowed: R[]) => (args: unknown, ctx?: ActionRunContext) => Promise<void>;
    requirePermission: (...permissions: P[]) => (args: unknown, ctx?: ActionRunContext) => Promise<void>;
    assertPermission: (permissions: readonly P[], caller?: AppRoleCaller) => Promise<void>;
}
export declare function getRegisteredAppRoles(appId: string): AppRolesDescriptor<string, string> | undefined;
export declare function listRegisteredAppRoles(): AppRolesDescriptor<string, string>[];
export declare function defineAppRoles<const R extends string, const P extends string = string>(descriptor: AppRolesDescriptor<R, P>, permissionPolicy?: AppPermissionPolicy<R>): AppRoles<R, P>;
export declare function resolveAppRole<R extends string>(descriptor: AppRolesDescriptor<R>, caller?: AppRoleCaller): Promise<AppRoleLookup<R>>;
export interface AppMemberRoleRow {
    email: string;
    roles: string[];
}
export declare function listAppMemberRoles(appId: string, orgId: string): Promise<AppMemberRoleRow[]>;
export declare function setAppMemberRoles(opts: {
    appId: string;
    orgId: string;
    email: string;
    roles: readonly string[];
    updatedBy: string;
}): Promise<void>;
/** @deprecated Use setAppMemberRoles instead. */
export declare function setAppMemberRole(opts: {
    appId: string;
    orgId: string;
    email: string;
    role: string | null;
    updatedBy: string;
}): Promise<void>;
export declare function getAppPermissionOverrides(appId: string, orgId: string): Promise<Record<string, string[]>>;
export declare function resolveAppAuthorizationContext(appId: string, caller: AppRoleCaller): Promise<AppAuthorizationContext | null>;
export declare function setAppPermissionRoles(opts: {
    appId: string;
    orgId: string;
    permission: string;
    roles: readonly string[] | null;
    updatedBy: string;
}): Promise<void>;
export declare function applyInvitationAppRoles(opts: {
    appRolesJson: string | null;
    orgId: string;
    email: string;
    updatedBy: string;
}): Promise<void>;