import type { RecordsCount } from '../interfaces/records-count.js';
import type { RecordsDelete } from '../interfaces/records-delete.js';
import type { RecordsQuery } from '../interfaces/records-query.js';
import type { RecordsRead } from '../interfaces/records-read.js';
import type { RecordsSubscribe } from '../interfaces/records-subscribe.js';
import type { RecordsWriteMessage } from '../types/records-types.js';
import type { ValidationStateReader } from '../types/validation-state-reader.js';
import type { ProtocolActionRule, ProtocolDefinition, ProtocolRuleSet } from '../types/protocols-types.js';
import { RecordsWrite } from '../interfaces/records-write.js';
import { ProtocolAction } from '../types/protocols-types.js';
/**
 * Check if the incoming message is invoking a role. If so, validate the invoked role.
 * For cross-protocol role invocation, the role record may live in a different protocol
 * (resolved via the composing protocol's `uses` map).
 */
export declare function verifyInvokedRole(tenant: string, incomingMessage: RecordsCount | RecordsDelete | RecordsQuery | RecordsRead | RecordsSubscribe | RecordsWrite, protocolUri: string, contextId: string | undefined, protocolDefinition: ProtocolDefinition, validationStateReader: ValidationStateReader, protocolDefinitionTimestamp?: string): Promise<void>;
/**
 * Returns all the ProtocolActions that would authorized the incoming message
 * (but we still need to later verify if there is a rule defined that matches one of the actions).
 * NOTE: the reason why there could be multiple actions is because:
 * - In case of an initial RecordsWrite, the RecordsWrite can be authorized by an allow `create` or `write` rule.
 * - In case of a non-initial RecordsWrite by the original record author, the RecordsWrite can be authorized by a `write` or `co-update` rule.
 *
 * It is important to recognize that the `write` access that allowed the original record author to create the record maybe revoked
 * (e.g. by role revocation) by the time a "non-initial" write by the same author is attempted.
 */
export declare function getActionsSeekingARuleMatch(tenant: string, incomingMessage: RecordsCount | RecordsDelete | RecordsQuery | RecordsRead | RecordsSubscribe | RecordsWrite, validationStateReader: ValidationStateReader): Promise<ProtocolAction[]>;
/**
 * Verifies the given message is authorized by one of the action rules in the given protocol rule set.
 * @param protocolDefinition Optional protocol definition for resolving cross-protocol `of` and `role` references.
 * @throws {Error} if action not allowed.
 */
export declare function authorizeAgainstAllowedActions(tenant: string, incomingMessage: RecordsCount | RecordsDelete | RecordsQuery | RecordsRead | RecordsSubscribe | RecordsWrite, ruleSet: ProtocolRuleSet, recordChain: RecordsWriteMessage[], validationStateReader: ValidationStateReader, protocolDefinition?: ProtocolDefinition): Promise<void>;
/**
 * Checks if the `who: 'author' | 'recipient'` action rule has a matching record in the record chain.
 * For cross-protocol `of` references (e.g., `"threads:thread"`), matches against both the protocol URI
 * and the protocol path of the ancestor record.
 * @returns `true` if the action rule is satisfied; `false` otherwise.
 */
export declare function checkActor(author: string, actionRule: ProtocolActionRule, recordChain: RecordsWriteMessage[], composingDefinition?: ProtocolDefinition): Promise<boolean>;
//# sourceMappingURL=protocol-authorization-action.d.ts.map