/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { AclEndpointContext, AclEntry, AclList, Fabric, IncomingSubjectDescriptor, MessageExchange } from "@matter/protocol";
import { ClusterId, FabricIndex, SubjectId } from "@matter/types";
import { AccessControl as AccessControlTypes } from "@matter/types/clusters/access-control";
declare const AccessControlServer_base: import("../../index.js").ClusterBehavior.Type<import("@matter/types").ClusterComposer.WithFeatures<AccessControlTypes.Cluster, readonly ["Extension"]>, import("./AccessControlBehavior.js").AccessControlBehaviorConstructor, import("./AccessControlInterface.js").AccessControlInterface>;
/**
 * This is the default server implementation of AccessControlBehavior.
 *
 * When custom extensions are used, the `extensionEntryValidator` and `extensionEntryAccessCheck` methods can be
 * overridden to implement custom validation and access checks for the extension entries.
 */
export declare class AccessControlServer extends AccessControlServer_base {
    #private;
    internal: AccessControlServer.Internal;
    initialize(): void;
    addDefaultCaseAcl(fabric: Fabric, subjects: SubjectId[]): void;
    /**
     * This method allows to implement the validation of manufacturer specific ACL extensions when an extension entry is
     * added or changed. The default implementation checks whether the extension is a valid TLV and possible to decode.
     *
     * In case of an Error throws StatusResponseError.
     *
     * Override this method in your own behavior to implement custom validation.
     */
    protected extensionEntryValidator(extension: AccessControlTypes.AccessControlExtension): void;
    /**
     * This method allows to implement the validation of manufacturer specific ACL extensions when access control is
     * checked to decide if access is allowed or not.
     * The default implementation always returns true. Override this method in your own behavior to implement custom
     * validation.
     */
    protected extensionEntryAccessCheck(_aclList: AclList, _aclEntry: AclEntry, _subjectDesc: IncomingSubjectDescriptor, _endpoint: AclEndpointContext, _clusterId: ClusterId): boolean;
}
export declare namespace AccessControlServer {
    class Internal {
        /** Is the cluster logic initialized? Used to block events before full initialization. */
        initialized: boolean;
        /**
         * When an online and potentially chunked ACL writing happens, we will delay the update and store the exchange
         * used for the writing. With this we also verify that concurrent writes are blocked and will not mix the data.
         */
        aclUpdateDelayed: Map<FabricIndex, MessageExchange | undefined>;
        /** Latest delayed data of acl attribute */
        delayedAclData: Map<FabricIndex, AccessControlTypes.AccessControlEntry[]>;
    }
    const ExtensionInterface: {
        extensionEntryValidator: (extension: AccessControlTypes.AccessControlExtension) => void;
        extensionEntryAccessCheck: (aclList: AclList, aclEntry: AclEntry, subjectDesc: IncomingSubjectDescriptor, endpoint: AclEndpointContext, clusterId: ClusterId) => boolean;
    };
}
export {};
//# sourceMappingURL=AccessControlServer.d.ts.map