import type { Filter } from '../types/query-types.js';
import type { MessagesFilter } from '../types/messages-types.js';
import type { MessageSigner } from '../types/signer.js';
import type { ProtocolDefinition } from '../types/protocols-types.js';
import type { ValidationStateReader } from '../types/validation-state-reader.js';
import type { ConnectSessionMetadata, PermissionConditions, PermissionGrantData, PermissionRequestData, PermissionRevocationData, PermissionScope } from '../types/permission-types.js';
import type { CoreProtocol, CoreProtocolStores } from '../core/core-protocol.js';
import type { DataEncodedRecordsWriteMessage, RecordsWriteMessage } from '../types/records-types.js';
import { PermissionGrant } from './permission-grant.js';
import { RecordsWrite } from '../interfaces/records-write.js';
/**
 * Options for creating a permission request.
 */
export type PermissionRequestCreateOptions = {
    /**
     * The signer of the request.
     */
    signer?: MessageSigner;
    dateRequested?: string;
    description?: string;
    delegated: boolean;
    scope: PermissionScope;
    conditions?: PermissionConditions;
};
/**
 * Options for creating a permission grant.
 */
export type PermissionGrantCreateOptions = {
    /**
     * The signer of the grant.
     */
    signer?: MessageSigner;
    grantedTo: string;
    dateGranted?: string;
    /**
     * Expire time in UTC ISO-8601 format with microsecond precision.
     */
    dateExpires: string;
    requestId?: string;
    description?: string;
    delegated?: boolean;
    scope: PermissionScope;
    conditions?: PermissionConditions;
    connectSession?: ConnectSessionMetadata;
};
/**
 * Options for creating a permission revocation.
 */
export type PermissionRevocationCreateOptions = {
    /**
     * The signer of the grant.
     */
    signer?: MessageSigner;
    /**
     * The PermissionGrant this revocation is for.
     */
    grant: PermissionGrant;
    dateRevoked?: string;
    description?: string;
};
/**
 * This is a first-class DWN protocol for managing permission grants of a given DWN.
 *
 * It implements the `CoreProtocol` interface so that its lifecycle hooks
 * (validation, pre-processing, post-processing) are dispatched generically
 * by the `CoreProtocolRegistry` rather than being hardcoded in handlers.
 */
export declare class PermissionsProtocol implements CoreProtocol {
    /**
     * The URI of the DWN Permissions protocol.
     */
    static readonly uri = "https://identity.foundation/dwn/permissions";
    /**
     * The protocol path of the `request` record.
     */
    static readonly requestPath = "request";
    /**
     * The protocol path of the `grant` record.
     */
    static readonly grantPath = "grant";
    /**
     * The protocol path of the `revocation` record.
     */
    static readonly revocationPath = "grant/revocation";
    /**
     * Canonical store predicate for the latest revocation of a permission grant.
     */
    static grantRevocationFilter(grantId: string): Filter;
    /**
     * The definition of the Permissions protocol.
     */
    static readonly definition: ProtocolDefinition;
    /** @inheritdoc */
    get uri(): string;
    /** @inheritdoc */
    get definition(): ProtocolDefinition;
    /** @inheritdoc */
    validateRecord(message: RecordsWriteMessage, dataBytes: Uint8Array): void;
    /**
     * Pre-processing hook for permission revocation records.
     * Validates that the revocation's `tags.protocol` matches the grant's scoped protocol.
     */
    preProcessWrite(tenant: string, message: RecordsWriteMessage, validationStateReader: ValidationStateReader): Promise<void>;
    /**
     * Post-processing hook for permission revocation records.
     * When a grant is revoked, all messages authorized by that grant and created
     * after the revocation timestamp are deleted from all stores.
     *
     * Deletion order is deliberate to avoid orphaned data in case of crash:
     *   1. data store  (large blobs first)
     *   2. message store
     */
    postProcessWrite(tenant: string, recordsWrite: RecordsWrite, stores: CoreProtocolStores): Promise<void>;
    /** @inheritdoc */
    mapErrorToStatusCode(errorCode: string): number | undefined;
    /**
     * Constructs an additional filter for protocol-scoped message queries so that
     * permission records (grants, requests, revocations) tagged with the target
     * protocol appear alongside that protocol's own records in sync/subscribe/read results.
     */
    constructAdditionalMessageFilter(filter: MessagesFilter): Filter | undefined;
    static parseRequest(base64UrlEncodedRequest: string): PermissionRequestData;
    /**
     * Convenience method to create a permission request.
     */
    static createRequest(options: PermissionRequestCreateOptions): Promise<{
        recordsWrite: RecordsWrite;
        permissionRequestData: PermissionRequestData;
        permissionRequestBytes: Uint8Array;
        dataEncodedMessage: DataEncodedRecordsWriteMessage;
    }>;
    /**
     * Convenience method to create a permission grant.
     */
    static createGrant(options: PermissionGrantCreateOptions): Promise<{
        recordsWrite: RecordsWrite;
        permissionGrantData: PermissionGrantData;
        permissionGrantBytes: Uint8Array;
        dataEncodedMessage: DataEncodedRecordsWriteMessage;
    }>;
    /**
     * Convenience method to create a permission revocation.
     */
    static createRevocation(options: PermissionRevocationCreateOptions): Promise<{
        recordsWrite: RecordsWrite;
        permissionRevocationData: PermissionRevocationData;
        permissionRevocationBytes: Uint8Array;
        dataEncodedMessage: DataEncodedRecordsWriteMessage;
    }>;
    /**
     * Validates the given Permissions protocol RecordsWrite. It can be a request, grant, or revocation.
     */
    static validateSchema(recordsWriteMessage: RecordsWriteMessage, dataBytes: Uint8Array): void;
    /**
     * Gets the scope from the given permission record.
     * If the record is a revocation, the scope is fetched from the grant that is being revoked.
     *
     * @param validationStateReader Used to fetch the grant for a revocation.
     */
    static getScopeFromPermissionRecord(tenant: string, validationStateReader: ValidationStateReader, incomingMessage: DataEncodedRecordsWriteMessage): Promise<PermissionScope>;
    /**
     * Normalizes the given permission scope if needed.
     * @returns The normalized permission scope.
     */
    private static normalizePermissionScope;
    /**
     * Type guard to determine if the scope is a record permission scope.
     */
    private static isRecordPermissionScope;
    /**
     * Type guard to determine if the permission is a protocol-scoped
     */
    static hasProtocolScope(scope: PermissionScope): scope is PermissionScope & {
        protocol: string;
    };
    private static hasSubtreeScope;
    private static hasConflictingSubtreeScope;
    /**
     * Validates that tags must include a protocol tag that matches the scoped protocol.
     */
    private static validateTags;
    /**
     * Validates scope and tags of the given permission request or grant.
     */
    private static validateScopeAndTags;
}
//# sourceMappingURL=permissions.d.ts.map