/**
 * Role grant offer RPC action specs — declarative contract for the
 * consentful-role-grants surface (offer lifecycle + admin revoke).
 *
 * Import this module for the specs, Input/Output schemas, `ERROR_ROLE_GRANT_OFFER_*`
 * reason constants, and the `all_role_grant_offer_action_specs` registry.
 * Handlers live in `auth/role_grant_offer_actions.ts`.
 *
 * Authorization enforcement: offer-lifecycle specs declare account+actor
 * required (no roles) and rely on `query_*` IDOR guards or in-handler
 * policy checks (e.g. `role_grant_offer_list`/`_history` elevate to admin only
 * when inspecting another account — an input-dependent check that can't be
 * expressed at the spec level). `role_grant_revoke` adds `roles: ['admin']` —
 * the RPC dispatcher's per-spec post-authorization auth gate
 * (`check_action_auth_post_authorization`) rejects non-admin callers before
 * the handler runs even though the endpoint hosts non-admin methods
 * alongside.
 *
 * @module
 */
import { z } from 'zod';
import type { RequestResponseActionSpec } from '../actions/action_spec.js';
/** Error reason — caller tried to offer themselves a role_grant. */
export declare const ERROR_ROLE_GRANT_OFFER_SELF_TARGET: "role_grant_offer_self_target";
/** Error reason — offer is declined, retracted, or superseded. */
export declare const ERROR_ROLE_GRANT_OFFER_TERMINAL: "role_grant_offer_terminal";
/** Error reason — offer's `expires_at` has passed. */
export declare const ERROR_ROLE_GRANT_OFFER_EXPIRED: "role_grant_offer_expired";
/** Error reason — offer does not exist or belongs to a different recipient (404-over-403 IDOR mask). */
export declare const ERROR_ROLE_GRANT_OFFER_NOT_FOUND: "role_grant_offer_not_found";
/** Error reason — the offered role does not include `'admin'` in its `RoleSpec.grant_paths` (nobody may offer it via this surface). */
export declare const ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE: "role_grant_offer_role_not_grantable";
/** Error reason — caller is not authorized to offer this role (default policy: caller lacks the role; consumer `authorize` callback may add further policy). */
export declare const ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED: "role_grant_offer_not_authorized";
/** Error reason — actor-targeted offer was accepted by an actor other than `to_actor_id`. */
export declare const ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH: "role_grant_offer_actor_mismatch";
/** Error reason — `role_grant_offer_create` was called with a `to_actor_id` that does not belong to `to_account_id`. */
export declare const ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH: "role_grant_offer_actor_account_mismatch";
/**
 * Input for `role_grant_offer_create`.
 *
 * `to_actor_id` (optional) narrows the offer to a specific actor on the
 * recipient account. When supplied, `role_grant_offer_accept` will only admit
 * the named actor — wrong-actor accepts reject with
 * `role_grant_offer_actor_mismatch`. The audit envelope's `target_actor_id` is
 * stamped from this column on the create / supersede / expire / retract
 * events. Omit (or pass null) for the account-grain default — any actor
 * on `to_account_id` may accept.
 */
export declare const RoleGrantOfferCreateInput: z.ZodObject<{
    to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
    to_actor_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
    role: z.ZodString;
    scope_kind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    scope_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
    message: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
}, z.core.$strict>;
export type RoleGrantOfferCreateInput = z.infer<typeof RoleGrantOfferCreateInput>;
/** Input for `role_grant_offer_accept`. */
export declare const RoleGrantOfferAcceptInput: z.ZodObject<{
    offer_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
}, z.core.$strict>;
export type RoleGrantOfferAcceptInput = z.infer<typeof RoleGrantOfferAcceptInput>;
/** Input for `role_grant_offer_decline`. */
export declare const RoleGrantOfferDeclineInput: z.ZodObject<{
    offer_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
    reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
}, z.core.$strict>;
export type RoleGrantOfferDeclineInput = z.infer<typeof RoleGrantOfferDeclineInput>;
/** Input for `role_grant_offer_retract`. */
export declare const RoleGrantOfferRetractInput: z.ZodObject<{
    offer_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
}, z.core.$strict>;
export type RoleGrantOfferRetractInput = z.infer<typeof RoleGrantOfferRetractInput>;
/** Input for `role_grant_offer_list`. `account_id` is admin-only (inspect another account's inbox). */
export declare const RoleGrantOfferListInput: z.ZodDefault<z.ZodObject<{
    account_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
}, z.core.$strict>>;
export type RoleGrantOfferListInput = z.infer<typeof RoleGrantOfferListInput>;
/**
 * Input for `role_grant_revoke`. Admin-only mutation that revokes an active
 * role_grant on a target actor. `actor_id` is the natural key — role_grants are
 * actor-scoped, and the admin UI reads `row.actor.id` straight from the
 * listing. Deriving `actor_id` from `account_id` would collapse under
 * multi-actor accounts.
 */
export declare const RoleGrantRevokeInput: z.ZodObject<{
    actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
    role_grant_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
    reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
}, z.core.$strict>;
export type RoleGrantRevokeInput = z.infer<typeof RoleGrantRevokeInput>;
/**
 * Input for `role_grant_offer_history`. Returns every offer involving the account
 * in either direction (recipient or grantor), including terminal rows, newest
 * first. `account_id` is admin-only.
 */
export declare const RoleGrantOfferHistoryInput: z.ZodDefault<z.ZodObject<{
    account_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
    limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
}, z.core.$strict>>;
export type RoleGrantOfferHistoryInput = z.infer<typeof RoleGrantOfferHistoryInput>;
/** Output for `role_grant_offer_create`. */
export declare const RoleGrantOfferCreateOutput: z.ZodObject<{
    offer: z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        to_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        role: z.ZodString;
        scope_kind: z.ZodNullable<z.ZodString>;
        scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        message: z.ZodNullable<z.ZodString>;
        created_at: z.ZodString;
        expires_at: z.ZodString;
        accepted_at: z.ZodNullable<z.ZodString>;
        declined_at: z.ZodNullable<z.ZodString>;
        decline_reason: z.ZodNullable<z.ZodString>;
        retracted_at: z.ZodNullable<z.ZodString>;
        superseded_at: z.ZodNullable<z.ZodString>;
        resulting_role_grant_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>;
}, z.core.$strict>;
export type RoleGrantOfferCreateOutput = z.infer<typeof RoleGrantOfferCreateOutput>;
/** Output for `role_grant_offer_accept`. */
export declare const RoleGrantOfferAcceptOutput: z.ZodObject<{
    role_grant_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
    offer: z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        to_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        role: z.ZodString;
        scope_kind: z.ZodNullable<z.ZodString>;
        scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        message: z.ZodNullable<z.ZodString>;
        created_at: z.ZodString;
        expires_at: z.ZodString;
        accepted_at: z.ZodNullable<z.ZodString>;
        declined_at: z.ZodNullable<z.ZodString>;
        decline_reason: z.ZodNullable<z.ZodString>;
        retracted_at: z.ZodNullable<z.ZodString>;
        superseded_at: z.ZodNullable<z.ZodString>;
        resulting_role_grant_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>;
    superseded_offer_ids: z.ZodArray<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
}, z.core.$strict>;
export type RoleGrantOfferAcceptOutput = z.infer<typeof RoleGrantOfferAcceptOutput>;
/** Output for `role_grant_offer_decline` / `role_grant_offer_retract`. */
export declare const RoleGrantOfferOkOutput: z.ZodObject<{
    ok: z.ZodLiteral<true>;
}, z.core.$strict>;
export type RoleGrantOfferOkOutput = z.infer<typeof RoleGrantOfferOkOutput>;
/** Output for `role_grant_offer_list`. */
export declare const RoleGrantOfferListOutput: z.ZodObject<{
    offers: z.ZodArray<z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        to_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        role: z.ZodString;
        scope_kind: z.ZodNullable<z.ZodString>;
        scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        message: z.ZodNullable<z.ZodString>;
        created_at: z.ZodString;
        expires_at: z.ZodString;
        accepted_at: z.ZodNullable<z.ZodString>;
        declined_at: z.ZodNullable<z.ZodString>;
        decline_reason: z.ZodNullable<z.ZodString>;
        retracted_at: z.ZodNullable<z.ZodString>;
        superseded_at: z.ZodNullable<z.ZodString>;
        resulting_role_grant_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type RoleGrantOfferListOutput = z.infer<typeof RoleGrantOfferListOutput>;
/** Output for `role_grant_offer_history`. */
export declare const RoleGrantOfferHistoryOutput: z.ZodObject<{
    offers: z.ZodArray<z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        to_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        role: z.ZodString;
        scope_kind: z.ZodNullable<z.ZodString>;
        scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        message: z.ZodNullable<z.ZodString>;
        created_at: z.ZodString;
        expires_at: z.ZodString;
        accepted_at: z.ZodNullable<z.ZodString>;
        declined_at: z.ZodNullable<z.ZodString>;
        decline_reason: z.ZodNullable<z.ZodString>;
        retracted_at: z.ZodNullable<z.ZodString>;
        superseded_at: z.ZodNullable<z.ZodString>;
        resulting_role_grant_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type RoleGrantOfferHistoryOutput = z.infer<typeof RoleGrantOfferHistoryOutput>;
/** Output for `role_grant_revoke`. */
export declare const RoleGrantRevokeOutput: z.ZodObject<{
    ok: z.ZodLiteral<true>;
    revoked: z.ZodLiteral<true>;
}, z.core.$strict>;
export type RoleGrantRevokeOutput = z.infer<typeof RoleGrantRevokeOutput>;
/**
 * `rate_limit: 'account'` throttles offer-spam at the authenticated
 * grantor and bounds the account-existence oracle on `to_account_id` —
 * the same shape as `invite_create_action_spec` upstream addresses, where
 * a hostile authed caller iterates recipients to probe
 * `ERROR_ACCOUNT_NOT_FOUND` (and the actor-binding via
 * `ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH`) as an enumeration
 * vector. Failure-outcome audit rows preserve the forensic trail; the
 * rate cap closes the budget.
 */
export declare const role_grant_offer_create_action_spec: {
    method: string;
    kind: "request_response";
    initiator: "frontend";
    auth: {
        account: "required";
        actor: "required";
    };
    side_effects: true;
    input: z.ZodObject<{
        to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        to_actor_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
        role: z.ZodString;
        scope_kind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
        scope_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
        message: z.ZodOptional<z.ZodNullable<z.ZodString>>;
        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>;
    output: z.ZodObject<{
        offer: z.ZodObject<{
            id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            to_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
            role: z.ZodString;
            scope_kind: z.ZodNullable<z.ZodString>;
            scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
            message: z.ZodNullable<z.ZodString>;
            created_at: z.ZodString;
            expires_at: z.ZodString;
            accepted_at: z.ZodNullable<z.ZodString>;
            declined_at: z.ZodNullable<z.ZodString>;
            decline_reason: z.ZodNullable<z.ZodString>;
            retracted_at: z.ZodNullable<z.ZodString>;
            superseded_at: z.ZodNullable<z.ZodString>;
            resulting_role_grant_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        }, z.core.$strict>;
    }, z.core.$strict>;
    async: true;
    description: string;
    error_reasons: ("role_grant_offer_self_target" | "role_grant_offer_role_not_grantable" | "role_grant_offer_not_authorized" | "role_grant_offer_actor_account_mismatch")[];
    rate_limit: "account";
};
export declare const role_grant_offer_accept_action_spec: {
    method: string;
    kind: "request_response";
    initiator: "frontend";
    auth: {
        account: "required";
        actor: "required";
    };
    side_effects: true;
    input: z.ZodObject<{
        offer_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>;
    output: z.ZodObject<{
        role_grant_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        offer: z.ZodObject<{
            id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            to_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
            role: z.ZodString;
            scope_kind: z.ZodNullable<z.ZodString>;
            scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
            message: z.ZodNullable<z.ZodString>;
            created_at: z.ZodString;
            expires_at: z.ZodString;
            accepted_at: z.ZodNullable<z.ZodString>;
            declined_at: z.ZodNullable<z.ZodString>;
            decline_reason: z.ZodNullable<z.ZodString>;
            retracted_at: z.ZodNullable<z.ZodString>;
            superseded_at: z.ZodNullable<z.ZodString>;
            resulting_role_grant_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        }, z.core.$strict>;
        superseded_offer_ids: z.ZodArray<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>;
    async: true;
    description: string;
    error_reasons: ("role_grant_offer_terminal" | "role_grant_offer_expired" | "role_grant_offer_not_found" | "role_grant_offer_actor_mismatch")[];
};
export declare const role_grant_offer_decline_action_spec: {
    method: string;
    kind: "request_response";
    initiator: "frontend";
    auth: {
        account: "required";
        actor: "required";
    };
    side_effects: true;
    input: z.ZodObject<{
        offer_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>;
    output: z.ZodObject<{
        ok: z.ZodLiteral<true>;
    }, z.core.$strict>;
    async: true;
    description: string;
    error_reasons: ("role_grant_offer_terminal" | "role_grant_offer_not_found")[];
};
export declare const role_grant_offer_retract_action_spec: {
    method: string;
    kind: "request_response";
    initiator: "frontend";
    auth: {
        account: "required";
        actor: "required";
    };
    side_effects: true;
    input: z.ZodObject<{
        offer_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>;
    output: z.ZodObject<{
        ok: z.ZodLiteral<true>;
    }, z.core.$strict>;
    async: true;
    description: string;
    error_reasons: ("role_grant_offer_terminal" | "role_grant_offer_not_found")[];
};
export declare const role_grant_offer_list_action_spec: {
    method: string;
    kind: "request_response";
    initiator: "frontend";
    auth: {
        account: "required";
        actor: "required";
    };
    side_effects: false;
    input: z.ZodDefault<z.ZodObject<{
        account_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>>;
    output: z.ZodObject<{
        offers: z.ZodArray<z.ZodObject<{
            id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            to_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
            role: z.ZodString;
            scope_kind: z.ZodNullable<z.ZodString>;
            scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
            message: z.ZodNullable<z.ZodString>;
            created_at: z.ZodString;
            expires_at: z.ZodString;
            accepted_at: z.ZodNullable<z.ZodString>;
            declined_at: z.ZodNullable<z.ZodString>;
            decline_reason: z.ZodNullable<z.ZodString>;
            retracted_at: z.ZodNullable<z.ZodString>;
            superseded_at: z.ZodNullable<z.ZodString>;
            resulting_role_grant_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        }, z.core.$strict>>;
    }, z.core.$strict>;
    async: true;
    description: string;
};
export declare const role_grant_offer_history_action_spec: {
    method: string;
    kind: "request_response";
    initiator: "frontend";
    auth: {
        account: "required";
        actor: "required";
    };
    side_effects: false;
    input: z.ZodDefault<z.ZodObject<{
        account_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
        limit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
        offset: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>>;
    output: z.ZodObject<{
        offers: z.ZodArray<z.ZodObject<{
            id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            from_actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
            to_actor_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
            role: z.ZodString;
            scope_kind: z.ZodNullable<z.ZodString>;
            scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
            message: z.ZodNullable<z.ZodString>;
            created_at: z.ZodString;
            expires_at: z.ZodString;
            accepted_at: z.ZodNullable<z.ZodString>;
            declined_at: z.ZodNullable<z.ZodString>;
            decline_reason: z.ZodNullable<z.ZodString>;
            retracted_at: z.ZodNullable<z.ZodString>;
            superseded_at: z.ZodNullable<z.ZodString>;
            resulting_role_grant_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        }, z.core.$strict>>;
    }, z.core.$strict>;
    async: true;
    description: string;
};
/**
 * `rate_limit: 'account'` bounds admin-side burn of `role_grant_revoke` —
 * the action is admin-gated and audit-trailed, but the per-account cap
 * keeps a single admin script from churning role_grants in a loop and
 * obscuring audit context for unrelated activity.
 */
export declare const role_grant_revoke_action_spec: {
    method: string;
    kind: "request_response";
    initiator: "frontend";
    auth: {
        account: "required";
        actor: "required";
        roles: string[];
    };
    side_effects: true;
    input: z.ZodObject<{
        actor_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        role_grant_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>;
    output: z.ZodObject<{
        ok: z.ZodLiteral<true>;
        revoked: z.ZodLiteral<true>;
    }, z.core.$strict>;
    async: true;
    description: string;
    error_reasons: ("role_not_web_grantable" | "role_grant_not_found")[];
    rate_limit: "account";
};
/**
 * All role-grant-offer action specs — a codegen-ready registry. Consumers spread
 * this into their own action-spec array to include offer lifecycle + revoke
 * methods in a typed client surface.
 */
export declare const all_role_grant_offer_action_specs: Array<RequestResponseActionSpec>;
//# sourceMappingURL=role_grant_offer_action_specs.d.ts.map