import type { RecordsWrite } from '../interfaces/records-write.js';
import type { RecordsWriteMessage } from '../types/records-types.js';
import type { ValidationStateReader } from '../types/validation-state-reader.js';
import type { ProtocolDefinition, ProtocolRuleSet, ProtocolType, ProtocolTypes } from '../types/protocols-types.js';
/**
 * Verifies the `protocolPath` declared in the given message matches the path of actual record chain.
 * For cross-protocol composition, the parent record may belong to a different protocol (resolved via `$ref` in the composing protocol).
 * @throws {DwnError} if fails verification.
 */
export declare function verifyProtocolPathAndContextId(tenant: string, inboundMessage: RecordsWrite, validationStateReader: ValidationStateReader, protocolDefinitionTimestamp?: string): Promise<void>;
/**
 * Resolves the protocol URI that should be used when querying for the parent record.
 * For standard (non-composed) records, this is the same as the child's protocol.
 * For cross-protocol composition, the parent may live in a different protocol
 * (resolved via `$ref` in the composing protocol's definition).
 *
 * Logic: Given a child at protocolPath `a/b/c`, the parent is at `a/b`.
 * Walk up the composing protocol's structure from root to `a/b`.
 * If any segment along the way has a `$ref`, the parent (and its ancestors up to the `$ref` boundary)
 * live in the referenced protocol. Specifically, the `$ref` at the topmost ancestor tells us
 * the parent's protocol URI.
 */
export declare function resolveParentProtocolUri(tenant: string, childProtocolUri: string, childProtocolPath: string, validationStateReader: ValidationStateReader, protocolDefinitionTimestamp?: string): Promise<string>;
/**
 * Verifies the `dataFormat` and `schema` declared in the given message matches the type in the protocol.
 * For cross-protocol composition, if the type is at a `$ref` position in the structure,
 * the type definition is looked up in the referenced protocol's `types` map instead.
 */
export declare function verifyTypeWithComposition(tenant: string, inboundMessage: RecordsWriteMessage, protocolDefinition: ProtocolDefinition, validationStateReader: ValidationStateReader, protocolDefinitionTimestamp?: string): Promise<void>;
/**
 * Resolves the `ProtocolTypes` map that contains the type definition for the given protocol path.
 * For non-composed records, this is the protocol definition's own `types` map.
 * For records at a `$ref` position, this is the referenced protocol's `types` map.
 */
export declare function resolveProtocolTypesForPath(tenant: string, protocolPath: string, protocolDefinition: ProtocolDefinition, validationStateReader: ValidationStateReader, protocolDefinitionTimestamp?: string): Promise<ProtocolTypes>;
/**
 * Verifies the `dataFormat` and `schema` declared in the given message (if it is a RecordsWrite) matches dataFormat
 * and schema of the type in the given protocol.
 * @throws {DwnError} if fails verification.
 */
export declare function verifyType(inboundMessage: RecordsWriteMessage, protocolTypes: ProtocolTypes, typeName?: string): ProtocolType;
/**
 * Verifies that writes adhere to the $size constraints if provided
 * @throws {Error} if size is exceeded.
 */
export declare function verifySizeLimit(incomingMessage: RecordsWrite, ruleSet: ProtocolRuleSet): void;
/**
 * Verifies record tags against the `$tags` schema in the rule set.
 * Checks required tags, additional properties, and schema conformance.
 */
export declare function verifyTagsIfNeeded(incomingMessage: RecordsWrite, ruleSet: ProtocolRuleSet): void;
/**
 * If the given RecordsWrite is not a role record, this method does nothing and succeeds immediately.
 *
 * Else it verifies the validity of the given `RecordsWrite` as a role record, including:
 * 1. The same role has not been assigned to the same entity/recipient.
 */
export declare function verifyAsRoleRecordIfNeeded(tenant: string, incomingMessage: RecordsWrite, ruleSet: ProtocolRuleSet, validationStateReader: ValidationStateReader): Promise<void>;
/**
 * Verifies that the `$recordLimit` strategy is supported for a new record creation.
 *
 * This check only applies to initial writes (new records). Updates to existing records do not
 * affect record-limit occupancy. The supported `reject` strategy admits every candidate and
 * projects the visible occupant set at read time, so validation stays independent of arrival order.
 *
 * @throws {DwnError} with `ProtocolAuthorizationRecordLimitStrategyNotImplemented` if strategy is not implemented.
 */
export declare function verifyRecordLimit(incomingMessage: RecordsWrite, ruleSet: ProtocolRuleSet): Promise<void>;
/**
 * Verifies that a `RecordsWrite` with `squash: true` is eligible:
 * 1. The protocol rule set at the record's `protocolPath` must have `$squash: true`.
 * 2. The squash write must be an initial write (a new record, not an update).
 *
 * @throws {DwnError} with `ProtocolAuthorizationSquashNotEnabled` if `$squash` is not enabled.
 * @throws {DwnError} with `ProtocolAuthorizationSquashNotInitialWrite` if the squash write is not an initial write.
 */
export declare function verifySquashEligibility(incomingMessage: RecordsWrite, ruleSet: ProtocolRuleSet): Promise<void>;
/**
 * Verifies that an update is not attempted on a record whose protocol path has `$immutable: true`.
 *
 * Only non-initial writes (updates) are rejected — initial writes are always allowed.
 * `RecordsDelete` is not affected by this check; immutability prevents data mutation, not removal.
 *
 * @throws {DwnError} with `ProtocolAuthorizationImmutableRecord` if an update is attempted on an immutable record.
 */
export declare function verifyImmutability(incomingMessage: RecordsWrite, ruleSet: ProtocolRuleSet): Promise<void>;
//# sourceMappingURL=protocol-authorization-validation.d.ts.map