import { type SQL } from "drizzle-orm";
import type { ExtensionChangeTarget } from "../extensions/change-marker.js";
import { type PrincipalType, type ShareRole } from "./schema.js";
export declare function normalizePrincipalId(principalType: PrincipalType, principalId: string): string;
export declare function isEmailPrincipalId(value: string): boolean;
export declare function principalIdMatches(sharesTable: any, principalType: PrincipalType, principalId: string): SQL;
export declare function isOrgMemberOrInvited(orgId: string, email: string): Promise<boolean>;
export interface GrantResourceAccessInput {
    resourceType: string;
    resourceId: string;
    principalType: PrincipalType;
    principalId: string;
    role: ShareRole;
    /**
     * Keep a stronger role the principal already holds instead of replacing it.
     * Share replaces roles in both directions; approving a request only raises.
     */
    keepStrongerRole?: boolean;
}
export interface GrantResourceAccessResult {
    /** The principal's share row. */
    id: string;
    /** A new share row was inserted. */
    created: boolean;
    /** An existing share row's role changed. */
    updated: boolean;
    /** The role the share row holds now. */
    role: ShareRole;
    principalId: string;
    /** The resource as the actor's admin access check loaded it. */
    resource: any;
    /** Pass to {@link announceResourceAccessChange} once the grant commits. */
    extensionTargetsBefore: ExtensionChangeTarget[];
}
/**
 * Gives a principal a role on a resource, as the signed-in actor. The actor
 * needs admin on the resource, and every sharing rule applies: group support,
 * organization-only sharing, and the principal's form. Share and approving an
 * access request both grant through here, so neither can skip a rule.
 *
 * It writes the share row, and undoes that write if the registration refuses
 * it after the write. Call {@link announceResourceAccessChange} afterwards,
 * outside any transaction, so open sessions see the change.
 */
export declare function grantResourceAccess(input: GrantResourceAccessInput): Promise<GrantResourceAccessResult>;
/**
 * Tells open sessions that a resource's sharing changed, after the grant that
 * changed it has committed.
 */
export declare function announceResourceAccessChange(resourceType: string, resourceId: string, extensionTargetsBefore: ExtensionChangeTarget[]): Promise<void>;