import type { DerivedPrivateJwk } from './hd-key.js';
import type { KeyDecrypter } from '../types/encryption-types.js';
import type { Filter, KeyValues, StartsWithFilter } from '../types/query-types.js';
import type { GenericMessage, GenericSignaturePayload, MessageSort } from '../types/message-types.js';
import type { RecordsCountMessage, RecordsDeleteMessage, RecordsFilter, RecordsQueryMessage, RecordsReadMessage, RecordsSubscribeMessage, RecordsWriteDescriptor, RecordsWriteMessage, RecordsWriteTags, RecordsWriteTagsFilter } from '../types/records-types.js';
import { DateSort } from '../types/records-types.js';
import { DwnErrorCode } from '../core/dwn-error.js';
import { ROLE_AUDIENCE_DERIVATION_SCHEME } from './encryption.js';
import { KeyDerivationScheme } from './hd-key.js';
/**
 * Class containing useful utilities related to the Records interface.
 */
export declare class Records {
    /**
     * Checks if the given message is a `RecordsWriteMessage`.
     */
    static isRecordsWrite(message: GenericMessage): message is RecordsWriteMessage;
    /**
     * Gets the newest `RecordsWrite` from the given message set.
     */
    static getNewestRecordsWrite(messages: GenericMessage[]): Promise<RecordsWriteMessage | undefined>;
    /**
     * Gets the newest `RecordsDelete` from the given message set.
     */
    static getNewestRecordsDelete(messages: GenericMessage[]): Promise<RecordsDeleteMessage | undefined>;
    /**
     * Decrypts the encrypted data in a message reply.
     *
     * Overload 1 (callback-based): Accepts a KeyDecrypter that performs
     * X25519-HKDF key agreement + AES Key Unwrap internally.
     */
    static decrypt(recordsWrite: RecordsWriteMessage, keyDecrypter: KeyDecrypter, cipherStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
    /**
     * Overload 2 (raw-key): Takes DerivedPrivateJwk directly.
     * @param ancestorPrivateKey Any ancestor private key in the key derivation path.
     */
    static decrypt(recordsWrite: RecordsWriteMessage, ancestorPrivateKey: DerivedPrivateJwk, cipherStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
    private static findMatchingKeyEncryption;
    private static validateEncryptedDataIntegrity;
    /**
     * Constructs full key derivation path using the specified scheme.
     */
    static constructKeyDerivationPath(keyDerivationScheme: KeyDerivationScheme | typeof ROLE_AUDIENCE_DERIVATION_SCHEME, recordsWriteMessage: RecordsWriteMessage): string[];
    /**
     * Constructs the full key derivation path using `protocolPath` scheme.
     *
     * The path is `[scheme, protocol, ...protocolPathSegments]`. Because each record's `protocol`
     * field always refers to the protocol it was written under, records in composed protocols
     * naturally derive independent key hierarchies — a `$ref` parent (referenced protocol) and
     * its children (composing protocol) use different protocol URIs and thus different key trees.
     */
    static constructKeyDerivationPathUsingProtocolPathScheme(descriptor: RecordsWriteDescriptor): string[];
    /**
     * Derives a descendant private key given an ancestor private key and the full absolute derivation path.
     * Uses X25519 keys for encryption key derivation.
     */
    static derivePrivateKey(ancestorPrivateKey: DerivedPrivateJwk, fullDescendantDerivationPath: string[]): Promise<Uint8Array>;
    /**
     * Validates that ancestor derivation path matches the descendant derivation path completely.
     * @throws {DwnError} with `DwnErrorCode.RecordsInvalidAncestorKeyDerivationSegment` if fails validation.
     */
    static validateAncestorKeyAndDescentKeyDerivationPathsMatch(ancestorKeyDerivationPath: string[], descendantKeyDerivationPath: string[]): void;
    /**
     * Extracts the parent context ID from the given context ID.
     */
    static getParentContextFromOfContextId(contextId: string | undefined): string | undefined;
    /**
     * Normalizes the protocol and schema URLs within a provided RecordsFilter and returns a copy of RecordsFilter with the modified values.
     *
     * @param filter incoming RecordsFilter to normalize.
     * @returns {RecordsFilter} a copy of the incoming RecordsFilter with the normalized properties.
     */
    static normalizeFilter(filter: RecordsFilter): RecordsFilter;
    /**
     * Nested protocol-path queries must pin one parent context. Otherwise the same
     * protocol type is read across every parent instance.
     */
    static validateNestedProtocolPathQueryScope(filter: RecordsFilter, errorCode: DwnErrorCode, operationName: string): void;
    static isStartsWithFilter(filter: RecordsWriteTagsFilter): filter is StartsWithFilter;
    /**
     * This will create individual keys for each of the tags that look like `tag.tag_property`
     */
    static buildTagIndexes(tags: RecordsWriteTags): KeyValues;
    /**
     * This will create individual keys for each of the tag filters that look like `tag.tag_filter_property`
     */
    static convertTagsFilter(tags: {
        [property: string]: RecordsWriteTagsFilter;
    }): Filter;
    /**
     *  Converts an incoming RecordsFilter into a Filter usable by MessageStore.
     *
     * @param filter A RecordsFilter
     * @returns {Filter} a generic Filter able to be used with MessageStore.
     */
    static convertFilter(filter: RecordsFilter, dateSort?: DateSort): Filter;
    /**
     * Validates the referential integrity of both author-delegated grant and owner-delegated grant.
     * @param authorSignaturePayload Decoded payload of the author signature of the message. Pass `undefined` if message is not signed.
     *                               Passed purely as a performance optimization so we don't have to decode the signature payload again.
     * @param ownerSignaturePayload Decoded payload of the owner signature of the message. Pass `undefined` if no owner signature is present.
     *                              Passed purely as a performance optimization so we don't have to decode the owner signature payload again.
     */
    static validateDelegatedGrantReferentialIntegrity(message: RecordsCountMessage | RecordsReadMessage | RecordsQueryMessage | RecordsWriteMessage | RecordsDeleteMessage | RecordsSubscribeMessage, authorSignaturePayload: GenericSignaturePayload | undefined, ownerSignaturePayload?: GenericSignaturePayload | undefined): Promise<void>;
    /**
     * Convert a `DateSort` value to a `MessageSort` object accepted by the `MessageStore`.
     * Defaults to `messageTimestamp` descending (most recently updated first) when no sort is given.
     *
     * @param dateSort the optional `DateSort` value.
     * @returns a `MessageSort` for `MessageStore` sorting.
     */
    static convertDateSort(dateSort?: DateSort): MessageSort;
    /**
     * Determines if signature payload contains a protocolRole and should be authorized as such.
     */
    static shouldProtocolAuthorize(signaturePayload: GenericSignaturePayload): boolean;
    /**
     * Checks if the filter supports returning published records.
     */
    static filterIncludesPublishedRecords(filter: RecordsFilter): boolean;
    /**
     * Checks if the filter supports returning unpublished records.
     */
    static filterIncludesUnpublishedRecords(filter: RecordsFilter): boolean;
    /**
     * Checks whether the given `RecordsDelete` is beaten by an existing tombstone for the record,
     * per the tombstone lattice. A tombstone displaces any `RecordsWrite` regardless of timestamp
     * (delete-wins). Among competing tombstones one canonical winner stands on every replica:
     * a prune beats a plain delete regardless of timestamp — the cascade is a side effect, and a
     * plain-newer winner would leave replicas that ran the cascade diverged from those that never
     * would — and within the same class the newest tombstone wins, with `Message.isNewer`'s
     * (messageTimestamp, CID) total order picking the same winner everywhere. Admission and
     * resumable-task replay must share this predicate: state can advance between acceptance and
     * replay, and replay must never admit a delete that admission would now reject.
     */
    static isDeleteBeatenByExistingTombstone(deleteToBePerformed: RecordsDeleteMessage, newestExistingMessage: GenericMessage): Promise<boolean>;
    /**
     * Checks whether or not the incoming records query filter should build an unpublished recipient MessageStore filter.
     *
     * @param filter The incoming RecordsFilter to evaluate against.
     * @param recipient The recipient to check against the filter, typically the query/subscribe message author.
     * @returns {boolean} True if the filter contains the recipient, or if the recipient filter is undefined/empty.
     */
    static shouldBuildUnpublishedRecipientFilter(filter: RecordsFilter, recipient: string): boolean;
    /**
     * Checks whether or not the incoming records query filter should build an unpublished author MessageStore filter.
     *
     * @param filter The incoming RecordsFilter to evaluate against.
     * @param author The author to check against the filter, typically the query/subscribe message author.
     * @returns {boolean} True if the filter contains the author, or if the author filter is undefined/empty.
     */
    static shouldBuildUnpublishedAuthorFilter(filter: RecordsFilter, author: string): boolean;
}
//# sourceMappingURL=records.d.ts.map