/**
 * Disclosure-role middleware.
 *
 * Resolves the highest currently-valid `DisclosureRole` grant for the
 * authenticated user and attaches it to the request so downstream handlers
 * and CDS projections can gate response width by tier.
 * When no grant applies, the default is `public_only`.
 *
 * The disclosure-role tiers map 1:1 to the EU Battery Regulation Annex XIII /
 * Art. 77 access tiers (general public / legitimate-interest / authority).
 * The middleware is intentionally orthogonal to CAP's `@requires` auth roles
 * — that gates access to *services*, this gates the *shape* of responses
 * within a service the caller already reached.
 */
import cds from '@sap/cds';
export type DisclosureRoleValue = 'public_only' | 'legitimate_interest' | 'authority';
export declare const DEFAULT_DISCLOSURE_ROLE: DisclosureRoleValue;
export declare const DISCLOSURE_ROLE_VALUES: readonly DisclosureRoleValue[];
export interface AttachDisclosureRoleOptions {
    /**
     * If supplied, restricts the lookup to grants whose `scope` matches this
     * value AND globally-scoped grants (NULL/empty scope). If omitted, only
     * globally-scoped grants apply.
     */
    scope?: string;
    /**
     * AttestationVault deployment address. When supplied, the tier is resolved
     * from the ON-CHAIN `DisclosureGrants` (the tamper-evident ACL) — the
     * caller's granteeId is matched against active grants for this contract,
     * and that result is AUTHORITATIVE (no fall-back to the off-chain
     * `DisclosureRoles` table). Omit to use the off-chain table (the original
     * behavior). See docs/feature-requests/expose-disclosure-grants.md §3.
     */
    contractAddress?: string;
    /**
     * Optional attestation payload hash. When supplied alongside
     * `contractAddress`, the on-chain match is narrowed to grants for this
     * specific attestation; otherwise any active grant on the contract counts.
     */
    payloadHash?: string;
}
/**
 * Looks up the authenticated user's highest disclosure tier and attaches it
 * to `req.disclosureRole`. Returns the resolved role for direct use inside a
 * handler.
 *
 * Two sources, selected by `options.contractAddress`:
 *   - on-chain (contractAddress set): the indexed `DisclosureGrants` ACL is
 *     authoritative — the caller's granteeId is matched against active grants.
 *   - off-chain (no contractAddress): the operator-configured `DisclosureRoles`
 *     table (original behavior).
 *
 * The lookup is small (one or two SELECTs keyed on `userId`/contract); we rank
 * in JS to keep the SQL portable across SQLite/HANA without a DB-specific
 * CASE WHEN.
 */
export declare function attachDisclosureRole(req: cds.Request, db: cds.DatabaseService, options?: AttachDisclosureRoleOptions): Promise<DisclosureRoleValue>;
export declare function isAuthority(role: DisclosureRoleValue | undefined): boolean;
export declare function isValidDisclosureRoleValue(value: unknown): value is DisclosureRoleValue;
/**
 * Tier comparison helper for handler-side gating. Higher tiers always satisfy
 * lower-tier requirements (`authority` meets `legitimate_interest` and below).
 */
export declare function meetsDisclosure(actual: DisclosureRoleValue | undefined, required: DisclosureRoleValue): boolean;
