import { type AccessRequestRow } from "./access-request-store.js";
import { type ResourceAccessStatus } from "./access.js";
import type { ShareRole } from "./schema.js";
export declare const ACCESS_REQUEST_NOTE_MAX_LENGTH = 500;
/** How long a declined requester waits before they can ask again. */
export declare const ACCESS_REQUEST_DECLINE_COOLDOWN_MS: number;
/** Requests one person can make in a day, across every resource. */
export declare const ACCESS_REQUESTS_PER_REQUESTER_PER_DAY = 20;
/** Requests one owner can receive in a day, across their resources. */
export declare const ACCESS_REQUESTS_PER_OWNER_PER_DAY = 50;
/**
 * How long a request nobody has been told about yet reads as still sending.
 * After that its send was cut off, and asking again sends it again; the
 * request's idempotency keys stop anyone it already reached hearing twice.
 */
export declare const ACCESS_REQUEST_SEND_WINDOW_MS: number;
/** Where someone who manages access reviews a request, relative to the app. */
export declare function accessRequestReviewPath(requestId: string): string;
/** The viewer's own request, as their access screen shows it. */
export interface ViewerAccessRequest {
    state: "pending";
    requestedAt: string;
}
export interface ResourceLinkStatus extends ResourceAccessStatus {
    /** Whether the viewer can ask for access now. Only for `denied`. */
    canRequest?: boolean;
    /** The viewer's open request, if any. Only for `denied`. */
    request?: ViewerAccessRequest;
}
/**
 * {@link resolveAccessStatus}, plus whether a viewer who can't open the
 * resource can ask for access, and their own open request if they already
 * asked. Registrations without `accessRequests` never offer it.
 */
export declare function resolveLinkStatus(resourceType: string, resourceId: string): Promise<ResourceLinkStatus>;
export type RequestResourceAccessResult = {
    state: "allowed";
} | {
    state: "requested";
    request: ViewerAccessRequest;
    sent: boolean;
};
/**
 * Asks the owner, and anyone with admin, to give the signed-in viewer access
 * to a resource they can't open. Asking again while a request is open sends
 * nothing; asking again after its send was cut off sends it again. If the
 * request is over a daily limit, or nobody could be told, it is withdrawn
 * and this fails, so the viewer never sees "sent" for a request nobody will
 * find.
 */
export declare function requestResourceAccess(input: {
    resourceType: string;
    resourceId: string;
    note?: string;
}): Promise<RequestResourceAccessResult>;
export interface AccessRequestReview {
    id: string;
    generation: number;
    state: AccessRequestRow["state"];
    requester: {
        email: string;
        name: string | null;
    };
    note: string | null;
    requestedAt: string;
    decidedAt: string | null;
    grantedRole: ShareRole | null;
    resource: {
        type: string;
        id: string;
        label: string;
        title: string;
        path: string | null;
    };
}
/** A request, for someone who manages access to its resource. */
export declare function getAccessRequestReview(requestId: string): Promise<AccessRequestReview>;
export interface ResourceAccessRequestList {
    /** The newest pending requests. */
    requests: AccessRequestReview[];
    /** Older pending requests exist beyond `requests`. */
    hasMore: boolean;
}
/** Pending requests for one resource, for someone who manages its access. */
export declare function listResourceAccessRequests(resourceType: string, resourceId: string): Promise<ResourceAccessRequestList>;
/**
 * Whether the requester was emailed that they're in: `skipped` when the app
 * has no email set up or the requester is a test identity, `failed` when
 * sending failed or the email setup is broken or unreadable.
 */
export type AccessGrantedEmail = "sent" | "skipped" | "failed";
/**
 * Gives the requester `role`, through the same grant and sharing rules as
 * Share, and closes the request in the same transaction. A stronger role the
 * requester already holds is kept. The access stands even when the email
 * telling them fails; `email` says so.
 */
export declare function approveAccessRequest(input: {
    requestId: string;
    generation: number;
    role: ShareRole;
}): Promise<{
    state: "approved";
    role: ShareRole;
    email: AccessGrantedEmail;
}>;
/** Closes a request without granting anything or telling the requester. */
export declare function declineAccessRequest(input: {
    requestId: string;
    generation: number;
}): Promise<{
    state: "declined";
}>;