import type { DwnInterface } from './types/dwn.js';
import type { GenericMessage } from '@enbox/dwn-sdk-js';
import type { NonEmptyStringArray, SyncAuthorizationGrant, SyncScope } from './types/sync.js';
import type { PermissionGrantEntry, PermissionsApi } from './types/permissions.js';
export type MessagesScopeResolution = {
    scope: SyncScope;
    permissionGrants: PermissionGrantEntry[];
};
export declare class SyncProtocolRootPermissionGrantMissingError extends Error {
    readonly protocol: string;
    constructor(messageType: DwnInterface, protocol: string);
}
/** Returns a sorted, duplicate-free grant ID set, or `undefined` for owner requests. */
export declare function toMessagesPermissionGrantIds(permissionGrantIds: string[] | undefined): NonEmptyStringArray | undefined;
/**
 * Gets the active permission grant IDs that authorize a Messages operation.
 *
 * Owner-authored Messages feed access does not invoke grants. Delegate full
 * scope requires at least one active unscoped Messages.Read grant. Delegate
 * protocol-set scope requires each requested protocol root to be covered by an
 * active Messages.Read grant, then invokes every active grant that participates
 * in that root set. This keeps the authorization epoch tied to grant churn
 * without widening the CID set being compared.
 */
export declare function getMessagesPermissionGrantsForScope({ did, delegateDid, protocols, messageType, permissionsApi, }: {
    did: string;
    delegateDid?: string;
    protocols?: NonEmptyStringArray;
    messageType: DwnInterface;
    permissionsApi: PermissionsApi;
}): Promise<PermissionGrantEntry[]>;
/**
 * Resolves active Messages.Read grants into one or more Messages feed scopes.
 *
 * Exact protocolPath and contextId grants do not authorize root log scopes
 * because they cover a strict subset of the messages in those scopes.
 */
export declare function resolveMessagesScopes({ did, delegateDid, requestedScope, messageType, permissionsApi, }: {
    did: string;
    delegateDid?: string;
    requestedScope: SyncScope;
    messageType: DwnInterface;
    permissionsApi: PermissionsApi;
}): Promise<MessagesScopeResolution[]>;
/** Converts permission grant entries into authorization epoch inputs. */
export declare function toSyncAuthorizationGrants(permissionGrants: PermissionGrantEntry[]): [SyncAuthorizationGrant, ...SyncAuthorizationGrant[]];
/** Returns sorted grant IDs from permission grant entries. */
export declare function permissionGrantIdsFromEntries(permissionGrants: PermissionGrantEntry[]): NonEmptyStringArray | undefined;
/**
 * Returns the permission grant IDs invoked by a message.
 *
 * Real DWN messages use the author signature payload as the source of truth.
 */
export declare function getInvokedPermissionGrantIds(message: GenericMessage): string[];
//# sourceMappingURL=sync-permission-grants.d.ts.map