import type { BaseMessage } from '../types/message-types.js';
import type { CID } from 'multiformats';
import type { DidResolver } from '../did/did-resolver.js';
import type { GeneralJws } from '../types/jws-types.js';
import type { Message } from './message.js';
declare type AuthorizationPayloadConstraints = {
    /** permissible properties within payload. Note that `descriptorCid` is implied and does not need to be added */
    allowedProperties: Set<string>;
};
/**
 * Authenticates then authorizes the given message using the "canonical" auth flow.
 * Some message auth require special handling such as `RecordsWrite` and `RecordsQuery`,
 * which would be incompatible with this auth flow.
 * @throws {Error} if auth fails
 */
export declare function canonicalAuth(tenant: string, incomingMessage: Message<BaseMessage>, didResolver: DidResolver): Promise<void>;
/**
 * Validates the structural integrity of the `authorization` property.
 * NOTE: signature is not verified.
 * @returns the parsed JSON payload object if validation succeeds.
 */
export declare function validateAuthorizationIntegrity(message: BaseMessage, authorizationPayloadConstraints?: AuthorizationPayloadConstraints): Promise<{
    descriptorCid: CID;
    [key: string]: any;
}>;
/**
 * Validates the signature(s) of the given JWS.
 * @throws {Error} if fails authentication
 */
export declare function authenticate(jws: GeneralJws | undefined, didResolver: DidResolver): Promise<void>;
/**
 * Authorizes the incoming message.
 * @throws {Error} if fails authentication
 */
export declare function authorize(tenant: string, incomingMessage: Message<BaseMessage>): Promise<void>;
export {};
//# sourceMappingURL=auth.d.ts.map