/**
 * True when `email` is an owner or admin of `orgId`. Throws when the role
 * cannot be read: guessing "member" would run a manager on the personal
 * credential the organization's is meant to replace. A database that never
 * created the org tables has no managers.
 */
export declare function readsOrgCredentialFirst(orgId: string | null | undefined, email: string): Promise<boolean>;
/** The caller's own rows: their `user` row and pre-organization `solo:` row. */
export declare function isPersonalCredentialScope(ref: {
    scope: string;
    scopeId: string;
}): boolean;
/**
 * `refs` in read order: unchanged for a member, the organization's rows ahead
 * of the caller's own for an owner or admin. Reads the role only when `refs`
 * hold both kinds.
 */
export declare function orderCredentialScopes<T extends {
    scope: string;
    scopeId: string;
}>(refs: readonly T[], orgId: string | null | undefined, email: string): Promise<T[]>;