import type { GenericMessage } from '../types/message-types.js';
import type { PermissionGrant } from '../protocols/permission-grant.js';
import type { ValidationStateReader } from '../types/validation-state-reader.js';
import type { MessagesQueryMessage, MessagesReadMessage, MessagesSubscribeMessage } from '../types/messages-types.js';
export declare class MessagesGrantAuthorization {
    static fetchPermissionGrants(tenant: string, validationStateReader: ValidationStateReader, permissionGrantIds: string[]): Promise<PermissionGrant[]>;
    /**
     * Authorizes a MessagesReadMessage using the given permission grant.
     * @param validationStateReader Used to check grant revocation and fetch related RecordsWrites if needed.
     */
    static authorizeMessagesRead(input: {
        messagesReadMessage: MessagesReadMessage;
        messageToRead: GenericMessage;
        expectedGrantor: string;
        expectedGrantee: string;
        permissionGrants: PermissionGrant[];
        validationStateReader: ValidationStateReader;
    }): Promise<void>;
    /**
     * Authorizes the scope of a permission grant for MessagesQuery or MessagesSubscribe.
     * @param validationStateReader Used to check if the grant has been revoked.
     */
    static authorizeQueryOrSubscribe(input: {
        incomingMessage: MessagesQueryMessage | MessagesSubscribeMessage;
        expectedGrantor: string;
        expectedGrantee: string;
        permissionGrants: PermissionGrant[];
        validationStateReader: ValidationStateReader;
    }): Promise<void>;
    private static authorizeFilterScope;
    private static someScopeMatches;
    private static hasUnscopedGrant;
    /**
     * Revalidates an already-open delegated MessagesSubscribe grant set at event
     * delivery time. Subscription messages are signed at open time, but grant
     * expiry and revocation must stop future delivery after the grant set becomes
     * invalid.
     */
    static authorizeSubscribeDelivery(input: {
        messagesSubscribeMessage: MessagesSubscribeMessage;
        expectedGrantor: string;
        expectedGrantee: string;
        permissionGrants: PermissionGrant[];
        validationStateReader: ValidationStateReader;
        deliveryTimestamp: string;
    }): Promise<void>;
    /**
     * Performs base validation on every invoked grant. The grant set is all-or-nothing:
     * unresolved, revoked, expired, or interface/method-mismatched grants fail the request.
     */
    private static performBaseValidationForGrantSet;
    /**
     * Determines whether the given record is inside a grant scope.
     */
    private static isScopeAuthorized;
    private static isRecordsMessageScopeAuthorized;
    private static isPermissionRecordScopeAuthorized;
    private static isEncryptionRecordScopeAuthorized;
    private static isProtocolsConfigureScopeAuthorized;
    private static getAssociatedRecordsWrite;
    private static getRecordsScopeTarget;
    private static getStringTag;
    private static isSubtreeScope;
}
//# sourceMappingURL=messages-grant-authorization.d.ts.map