/**
 * `ctx.grant` / `ctx.revoke`'s writes to `_substrat_tuples`, as one statement each for both
 * adapters (#2071).
 *
 * A revoke TOMBSTONES (K-21): the row stays with `revoked_at` set, the checker's walk skips it,
 * and it stays readable as evidence that the key was taken back. It used to be a `DELETE`,
 * which left "revoked" and "never held" as the same absent row. That is the one distinction a
 * declared entity-grant shape's top-up needs (`entity-grant-shape.ts`): a key someone took back
 * from a person must not come back with the next release.
 *
 * A grant is the EXPLICIT write, so it clears a tombstone: a re-grant grants, as
 * `assignScopeRole` and `HostAdmin.grant` already do. A live row is left exactly as it is,
 * expiry included, because `ctx.grant` has never shortened or lengthened a grant it found.
 */
import type { SwitchSql } from './system-switch.js';
type Params = [string, string, string];
/**
 * A key only its shape may give, stored on the scope's tuple spine: every current and retired key of
 * a reconciled `'grantee'` or binding shape (#2083, #1686). The stored relation keeps its first name.
 */
export declare const SHAPE_PROTECTED_KEY_RELATION = "shape-grantee-key";
/**
 * The entity types whose shape protects a `granted:<key>` relation, as `entity_type` rows. The
 * subject range keeps it on the primary key: `shape:` rows only. One spelling for the two places
 * that ask: the explicit writer below refuses the key on a record of such a type, and the
 * permission walk stops at one for that key (`permission-eval.ts`, #2177).
 *
 * The range's bounds are parameters, not literals: the scope DO judges whether a statement writes
 * by its text (`isWriteStatement`), and a `;` inside a literal would read as a second statement,
 * counting every check that asks as a write.
 */
export declare function shapeProtectedTypesQuery(relation: string): {
    sql: string;
    params: [string, string, string, string];
};
/** The explicit scope-tuple write for admin/local grants and ctx.grant, behind one shape guard. */
export declare function writeExplicitTupleIn(db: SwitchSql, subject: string, relation: string, object: string, mode: {
    kind: 'replace';
    expiresAt: string | null;
} | {
    kind: 'delegated';
}): void;
/**
 * The explicit tuple write: insert it, or bring a tombstoned one back with no expiry. A live
 * row is untouched. `ctx.grant` and a declared shape's grant (`entity-grant-shape.ts`) share it.
 */
export declare function explicitTupleSql(subject: string, relation: string, object: string): {
    sql: string;
    params: Params;
};
/** Tombstone a live grant. A repeat revoke, or a revoke of a grant never made, changes nothing. */
export declare function delegatedRevokeSql(principal: string, permission: string, object: string, at: string): {
    sql: string;
    params: [string, ...Params];
};
export {};
//# sourceMappingURL=entity-grant.d.ts.map