//#region src/auth/authz/credential-gateway.d.ts
/**
 * Grant an app permission to read a credential.
 *
 * Requires the full credential scope (tenantId + projectId + credentialReferenceId)
 * because credential_reference IDs are only unique within a project; the SpiceDB
 * object ID is constructed via {@link toSpiceDbCredentialReferenceId}.
 */
declare function grantAppCredentialAccess(params: {
  tenantId: string;
  projectId: string;
  credentialReferenceId: string;
  appId: string;
}): Promise<void>;
/**
 * Revoke an app's permission to read a credential.
 */
declare function revokeAppCredentialAccess(params: {
  tenantId: string;
  projectId: string;
  credentialReferenceId: string;
  appId: string;
}): Promise<void>;
/**
 * Check whether an app has permission to read a credential.
 */
declare function canAppReadCredential(params: {
  tenantId: string;
  projectId: string;
  credentialReferenceId: string;
  appId: string;
}): Promise<boolean>;
/**
 * Atomically reconcile the credential an app is granted read access to.
 *
 * One call covers all transitions:
 *   - prior=∅, next=∅              → no-op
 *   - prior=∅, next=Y              → TOUCH new
 *   - prior=X, next=∅              → DELETE old  (fixes the "user cleared the credential" case)
 *   - prior=X, next=X              → idempotent TOUCH (collapsed, safe no-op in practice)
 *   - prior=X, next=Y (X≠Y)        → DELETE old + TOUCH new in a single writeRelationships batch
 *
 * All mutations are issued via `WriteRelationships.updates[]`, so any transition
 * involving both a delete and a write is observed atomically by readers (one
 * zedtoken, no window where neither the old nor the new tuple is valid).
 *
 * Mirrors the pattern used by `changeOrgRole` / `changeProjectRole` in sync.ts.
 */
declare function rewriteAppCredentialAccess(params: {
  tenantId: string;
  projectId: string;
  priorCredentialReferenceId?: string;
  nextCredentialReferenceId?: string;
  appId: string;
}): Promise<void>;
//#endregion
export { canAppReadCredential, grantAppCredentialAccess, revokeAppCredentialAccess, rewriteAppCredentialAccess };