import type { RecordsCount } from '../interfaces/records-count.js';
import type { RecordsDelete } from '../interfaces/records-delete.js';
import type { RecordsQuery } from '../interfaces/records-query.js';
import type { RecordsRead } from '../interfaces/records-read.js';
import type { RecordsSubscribe } from '../interfaces/records-subscribe.js';
import type { RecordsWrite } from '../interfaces/records-write.js';
import type { ValidationStateReader } from '../types/validation-state-reader.js';
import type { ProtocolRuleSet } from '../types/protocols-types.js';
export declare class ProtocolAuthorization {
    /**
     * Performs validation on the structure of RecordsWrite messages that use a protocol.
     * @throws {Error} if validation fails.
     */
    static validateReferentialIntegrity(tenant: string, incomingMessage: RecordsWrite, validationStateReader: ValidationStateReader): Promise<ProtocolRuleSet>;
    /**
     * Revalidates a stored initial write against the protocol definition that governed its creation timestamp.
     *
     * This is used only for destructive config-history repair, so it deliberately validates config-owned
     * structure and avoids live dependency checks. Missing grant, role, or parent records must not cause
     * an already-admitted record to be hard-purged.
     */
    static validateStoredInitialWrite(tenant: string, incomingMessage: RecordsWrite, validationStateReader: ValidationStateReader): Promise<void>;
    /**
     * Performs protocol-based authorization against the incoming RecordsWrite message.
     * @throws {Error} if authorization fails.
     */
    static authorizeWrite(tenant: string, incomingMessage: RecordsWrite, validationStateReader: ValidationStateReader): Promise<void>;
    /**
     * Performs protocol-based authorization against the incoming `RecordsRead` message.
     * @param newestRecordsWrite The latest RecordsWrite associated with the recordId being read.
     * @throws {Error} if authorization fails.
     */
    static authorizeRead(tenant: string, incomingMessage: RecordsRead, newestRecordsWrite: RecordsWrite, validationStateReader: ValidationStateReader): Promise<void>;
    static authorizeQueryOrSubscribe(tenant: string, incomingMessage: RecordsCount | RecordsQuery | RecordsSubscribe, validationStateReader: ValidationStateReader): Promise<void>;
    /**
     * Performs protocol-based authorization against the incoming `RecordsDelete` message.
     * @param recordsWrite A `RecordsWrite` of the record being deleted.
     */
    static authorizeDelete(tenant: string, incomingMessage: RecordsDelete, recordsWrite: RecordsWrite, validationStateReader: ValidationStateReader): Promise<void>;
    /**
     * Gets the rule set corresponding to the given protocolPath.
     */
    private static getRuleSet;
    private static verifyStoredInitialWrite;
    private static verifyStoredInitialWriteRoleRecipientIfNeeded;
    private static verifyStoredInitialWriteCreateAction;
    private static isStoredInitialWriteDirectlyAuthorized;
}
//# sourceMappingURL=protocol-authorization.d.ts.map