import type { MessageStore } from '../types/message-store.js';
import type { RecordsDelete } from '../interfaces/records-delete.js';
import type { RecordsQuery } from '../interfaces/records-query.js';
import type { RecordsRead } from '../interfaces/records-read.js';
import { RecordsWrite } from '../interfaces/records-write.js';
export declare class ProtocolAuthorization {
    /**
     * Performs validation on the structure of RecordsWrite messages that use a protocol.
     * @throws {Error} if validation fails.
     */
    static validateReferentialIntegrity(tenant: string, incomingMessage: RecordsWrite, messageStore: MessageStore): Promise<void>;
    /**
     * Performs protocol-based authorization against the incoming RecordsWrite message.
     * @throws {Error} if authorization fails.
     */
    static authorizeWrite(tenant: string, incomingMessage: RecordsWrite, messageStore: MessageStore): Promise<void>;
    /**
     * Performs protocol-based authorization against the incoming RecordsRead  message.
     * @param newestRecordsWrite Either the incomingMessage itself if the incoming is a RecordsWrite,
     *                     or the latest RecordsWrite associated with the recordId being read.
     * @throws {Error} if authorization fails.
     */
    static authorizeRead(tenant: string, incomingMessage: RecordsRead, newestRecordsWrite: RecordsWrite, messageStore: MessageStore): Promise<void>;
    /**
     * Performs protocol-based authorization against the incoming RecordsQuery message.
     * @throws {Error} if authorization fails.
     */
    static authorizeQuery(tenant: string, incomingMessage: RecordsQuery, messageStore: MessageStore): Promise<void>;
    static authorizeDelete(tenant: string, incomingMessage: RecordsDelete, newestRecordsWrite: RecordsWrite, messageStore: MessageStore): Promise<void>;
    /**
     * Fetches the protocol definition based on the protocol specified in the given message.
     */
    private static fetchProtocolDefinition;
    /**
     * Constructs a chain of ancestor messages
     * @returns the ancestor chain of messages where the first element is the root of the chain; returns empty array if no parent is specified.
     */
    private static constructAncestorMessageChain;
    /**
     * Gets the rule set corresponding to the given message chain.
     */
    private static getRuleSet;
    /**
     * Verifies the `protocolPath` declared in the given message (if it is a RecordsWrite) matches the path of actual ancestor chain.
     * @throws {DwnError} if fails verification.
     */
    private static verifyProtocolPath;
    /**
     * Verifies the `dataFormat` and `schema` declared in the given message (if it is a RecordsWrite) matches dataFormat
     * and schema of the type in the given protocol.
     * @throws {DwnError} if fails verification.
     */
    private static verifyType;
    /**
     * Check if the incoming message is invoking a role. If so, validate the invoked role.
     */
    private static verifyInvokedRole;
    /**
     * Returns a list of ProtocolAction(s) based on the incoming message, one of which must be allowed for the message to be authorized.
     */
    private static getActionsSeekingARuleMatch;
    /**
     * Verifies the action (e.g. read/write) specified in the given message matches the allowed actions in the rule set.
     * @throws {Error} if action not allowed.
     */
    private static verifyAllowedActions;
    /**
     * Verifies that writes to a $globalRole or $contextRole record do not have the same recipient as an existing RecordsWrite
     * to the same $globalRole or the same $contextRole in the same context.
     */
    private static verifyUniqueRoleRecipient;
    private static getRuleSetAtProtocolPath;
    /**
     * Checks if there is a record in the ancestor chain matching the `who: 'author' | 'recipient'` action rule.
     * @returns true if the action rule is satisfied. false otherwise
     */
    private static checkActor;
    private static getTypeName;
}
//# sourceMappingURL=protocol-authorization.d.ts.map