import type { DwnInterface } from './types/dwn.js';
import type { GenericMessage } from '@enbox/dwn-sdk-js';
import type { NonEmptyStringArray, SyncAuthorizationGrant, SyncScope } from './types/sync.js';
import type { PermissionGrantEntry, PermissionsApi } from './types/permissions.js';
export type MessagesSyncScopeResolution = {
    scope: SyncScope;
    permissionGrants: PermissionGrantEntry[];
};
/** Returns a sorted, duplicate-free grant ID set, or `undefined` for owner requests. */
export declare function toMessagesPermissionGrantIds(permissionGrantIds: string[] | undefined): NonEmptyStringArray | undefined;
/**
 * Gets the active permission grant IDs that authorize a Messages operation.
 *
 * Owner-authored sync does not invoke grants. Delegate full sync requires at
 * least one active unscoped Messages.Read grant. Delegate protocol-set sync
 * requires each requested protocol to be covered by an active Messages.Read
 * grant, then invokes every active grant that participates in the projection.
 * This keeps the authorization epoch tied to grant churn without widening the
 * CID projection being compared.
 */
export declare function getMessagesPermissionGrantsForScope({ did, delegateDid, protocols, messageType, permissionsApi, }: {
    did: string;
    delegateDid?: string;
    protocols?: NonEmptyStringArray;
    messageType: DwnInterface;
    permissionsApi: PermissionsApi;
}): Promise<PermissionGrantEntry[]>;
/**
 * Resolves active Messages.Read grants into one or more sync targets.
 *
 * Broad protocol coverage remains on StateIndex full/protocol roots. Exact
 * protocolPath and contextId grants are grouped into a Records-primary
 * projection target so a narrow grant never authorizes a broad protocol root.
 */
export declare function resolveMessagesSyncScopes({ did, delegateDid, requestedScope, messageType, permissionsApi, }: {
    did: string;
    delegateDid?: string;
    requestedScope: SyncScope;
    messageType: DwnInterface;
    permissionsApi: PermissionsApi;
}): Promise<MessagesSyncScopeResolution[]>;
/** Converts permission grant entries into authorization epoch inputs. */
export declare function toSyncAuthorizationGrants(permissionGrants: PermissionGrantEntry[]): [SyncAuthorizationGrant, ...SyncAuthorizationGrant[]];
/** Returns sorted grant IDs from permission grant entries. */
export declare function permissionGrantIdsFromEntries(permissionGrants: PermissionGrantEntry[]): NonEmptyStringArray | undefined;
/**
 * Returns the permission grant IDs invoked by a message.
 *
 * Real DWN messages use the author signature payload as the source of truth.
 */
export declare function getInvokedPermissionGrantIds(message: GenericMessage): string[];
//# sourceMappingURL=sync-permission-grants.d.ts.map