/**
 * Cell-grant ACL RPC handlers.
 *
 * Three `request_response` actions bound to specs in
 * `./cell_grant_action_specs.ts`:
 *
 * Grant management is **manage-tier only** (`can_manage_cell` = admin /
 * owner). Editor-grant holders may edit a cell's content + relations but
 * cannot manage its grants — delegating the share list would let an editor
 * widen access or mint peer editors and escape the manager's authority.
 *
 * - `cell_grant_create` — admin / owner only. Validates role-shaped
 *   principals against the role schema; rejects owner-as-principal.
 *   Actor-shaped principals carry a pre-resolved `actor_id` (callers pick
 *   via `actor_search`). Idempotent — re-granting the same principal
 *   updates `level` via UPSERT.
 * - `cell_grant_revoke` — admin / owner, plus self for actor-shaped grants
 *   ("leave shared cell"). Returns `still_admitted` computed by re-running
 *   `can_view_cell` against the remaining grants.
 * - `cell_grant_list` — admin / owner only. Viewers and editors alike get
 *   the IDOR-mask 404 (the share list is the manager's to curate).
 *
 * All three 404 with `cell_not_found` on cell-miss / cell-unviewable, and
 * with `cell_grant_not_found` on grant-miss, mirroring the existence-leak
 * guards in `cell_actions.ts`.
 *
 * Audit events `cell_grant_create` / `cell_grant_revoke` carry IDs only
 * (no display-name snapshots); see `./cell_grant_audit_metadata.ts`.
 *
 * @module
 */
import { type RpcAction } from '../actions/action_rpc.js';
import type { RoleSchemaResult } from './role_schema.js';
import type { RouteFactoryDeps } from './deps.js';
import { type GrantJson } from './cell_grant_action_specs.js';
import { type CellGrantRow } from '../db/cell_grant_queries.js';
/**
 * Dependencies for `create_cell_grant_actions`.
 *
 * `roles` is the role schema — read for the role-validity gate on
 * `cell_grant_create`. The other slots match `CellActionDeps` so
 * audit-log emit goes through the same fire-and-forget plumbing.
 */
export type CellGrantActionDeps = Pick<RouteFactoryDeps, 'log' | 'audit'> & {
    roles: RoleSchemaResult;
};
export declare const to_grant_json: (row: CellGrantRow) => GrantJson;
/** Create the three `cell_grant_*` RPC actions. */
export declare const create_cell_grant_actions: (deps: CellGrantActionDeps) => Array<RpcAction>;
//# sourceMappingURL=cell_grant_actions.d.ts.map