import type { MessageStore } from '../types/message-store.js';
import type { RecordsWrite } from '../interfaces/records-write.js';
import type { ValidationStateReader } from '../types/validation-state-reader.js';
import type { Filter, PaginationCursor } from '../types/query-types.js';
import type { RecordsCountMessage, RecordsFilter, RecordsQueryMessage, RecordsReadMessage, RecordsSubscribeMessage, RecordsWriteMessage } from '../types/records-types.js';
type ControlReadMessage = RecordsCountMessage | RecordsReadMessage | RecordsQueryMessage | RecordsSubscribeMessage;
type ControlFilterMessage = RecordsCountMessage | RecordsQueryMessage | RecordsSubscribeMessage;
type ControlFilterInput<T extends RecordsWriteMessage> = {
    tenant: string;
    incomingMessage: ControlFilterMessage;
    requester: string | undefined;
    recordsWriteMessages: T[];
    validationStateReader: ValidationStateReader;
};
export declare class EncryptionControl {
    static isControlMessage(message: RecordsWriteMessage): boolean;
    static isAudienceControlMessage(message: RecordsWriteMessage): boolean;
    static isExactAudienceFilter(filter: RecordsFilter): boolean;
    static filterTargetsOnlyControlRecords(filter: RecordsFilter): boolean;
    static authorizeControlReadRequest(input: {
        tenant: string;
        incomingMessage: ControlReadMessage;
        requester: string | undefined;
        validationStateReader: ValidationStateReader;
    }): Promise<void>;
    static buildAudienceRecordFilters(filters: Filter[]): Filter[];
    /**
     * Resolves the current audience record for a role-audience tuple.
     *
     * Current-key projection orders stored audience records by:
     * tenant-authored actual signer first, then oldest `dateCreated`, then `recordId` ascending.
     */
    static resolveCurrentAudienceRecord(input: {
        messageStore: MessageStore;
        tenant: string;
        protocol: string;
        rolePath: string;
        contextId: string;
    }): Promise<RecordsWriteMessage | undefined>;
    static projectCurrentAudienceRecords<T extends RecordsWriteMessage>(input: {
        messageStore: MessageStore;
        tenant: string;
        recordsWriteMessages: T[];
        bypassFilters?: Filter[];
        currentAudienceRecordIdCache?: Map<string, string | undefined>;
    }): Promise<T[]>;
    static projectCurrentAudienceRecordPage<T extends RecordsWriteMessage>(input: {
        messageStore: MessageStore;
        tenant: string;
        filters: Filter[];
        result: {
            messages: T[];
            cursor?: PaginationCursor;
        };
        currentAudienceRecordIdCache?: Map<string, string | undefined>;
    }): Promise<{
        messages: T[];
        cursor?: PaginationCursor;
    }>;
    static filterVisibleControlRecords<T extends RecordsWriteMessage>(input: ControlFilterInput<T>): Promise<T[]>;
    static authorizeRead(input: {
        tenant: string;
        incomingMessage: ControlReadMessage;
        requester: string | undefined;
        recordsWriteMessage: RecordsWriteMessage;
        validationStateReader: ValidationStateReader;
    }): Promise<void>;
    static canRead(input: {
        tenant: string;
        incomingMessage: ControlReadMessage;
        requester: string | undefined;
        recordsWriteMessage: RecordsWriteMessage;
        validationStateReader: ValidationStateReader;
    }): Promise<boolean>;
    static authorizeWrite(tenant: string, recordsWrite: RecordsWrite, validationStateReader: ValidationStateReader): Promise<void>;
    static validateReferentialIntegrity(tenant: string, recordsWrite: RecordsWrite, validationStateReader: ValidationStateReader): Promise<void>;
    static preProcessWrite(tenant: string, message: RecordsWriteMessage, validationStateReader: ValidationStateReader): Promise<void>;
    static validateRecord(input: {
        tenant: string;
        message: RecordsWriteMessage;
        dataBytes: Uint8Array;
        validationStateReader: ValidationStateReader;
    }): Promise<void>;
    static mapErrorToStatusCode(errorCode: string): number | undefined;
    private static preProcessAudience;
    private static preProcessDelivery;
    private static validateAudience;
    private static verifyEncryptedDelivery;
    private static verifyInlineControlRecord;
    private static verifyAudiencePayloadMatchesTags;
    private static verifyRoleAudienceDefinition;
    private static verifyRoleAudienceContext;
    private static resolveEffectiveControlActor;
    private static verifyActorCanCreateRole;
    private static actorCanCreateRole;
    private static verifyDeliveryRecipientAuthority;
    private static deliveryRecipientIsRoleHolder;
    private static grantCoversRoleCreate;
    private static canEnumerateAudience;
    private static canReadDeliveryByDelegatedGrant;
    private static getInvokedReadGrants;
    private static grantCoversAudienceEnumeration;
    private static resolveRoleAudienceDefinition;
    private static verifyGrantConditions;
    private static constructRoleParentChain;
    private static roleRuleAllowsActor;
    private static hasRoleRecord;
    private static resolveRoleReference;
    private static getRoleAudienceKeyId;
    private static getDeliveryTags;
    private static getRecordType;
    private static isVisibleControlRecord;
    private static exactAudienceFilterMatchesRecord;
    private static getExactAudienceFilterTuple;
    private static exactAudienceRequestMatchesRecord;
    private static getExactFilterTag;
    private static queryStoredAudienceRecordsForTuple;
    private static resolveCurrentAudienceRecordId;
    private static shouldProjectAudienceRecord;
    private static audienceProjectionBypassFilterMatchesRecord;
    private static getAudienceTupleKey;
    private static parseAudienceTupleKey;
    static compareAudienceProjectionCandidates(tenant: string, left: RecordsWriteMessage, right: RecordsWriteMessage): number;
    private static getRequiredStringTag;
    private static getOptionalStringTag;
}
export {};
//# sourceMappingURL=encryption-control.d.ts.map