import type { Sphere } from "./did.js";
export type EthosVerb = "read" | "edit" | "append" | "delete" | "write";
export type EthosSelector = {
    readonly kind: "all";
} | {
    readonly kind: "id";
    readonly id: string;
} | {
    readonly kind: "prefix";
    readonly prefix: string;
} | {
    readonly kind: "tag";
    readonly tag: string;
};
export interface ParsedEthosScope {
    readonly verb: EthosVerb;
    /** A concrete sphere, or `"all"` for the legacy whole-everything `ethos.read.all`. */
    readonly zone: Sphere | "all";
    readonly selector: EthosSelector;
}
/**
 * Parse `ethos.<verb>.<zone>[#<selector>]`. Returns `null` if the string is not
 * an ethos scope or the grammar is malformed — callers MUST treat `null` as
 * "grants nothing" (fail-closed, §4.8.5′), never as a whole-zone grant.
 */
export declare function parseEthosScope(scope: string): ParsedEthosScope | null;
/** A section as seen for authorization. `tags` is absent when the zone index is
 *  encrypted (self at the provider) — a tag selector then does NOT match
 *  (§4.8.4′: tag write-perimeters on self are advisory, not provider-enforced). */
export interface SectionRef {
    readonly id: string;
    readonly tags?: readonly string[];
}
/** §4.8.1′ — does `section` match `selector`? */
export declare function matchSection(section: SectionRef, selector: EthosSelector): boolean;
/** The three structural operations a publish can perform on a section. */
export type EthosOp = "create" | "edit" | "delete";
/**
 * §4.8.3′ — does the scope set authorize `op` on `section` of `zone`?
 *
 * `ethos.read.all` never authorizes a write (it is a read grant). Tag selectors
 * only match when `section.tags` is provided; the Ethos API passes `tags`
 * undefined for `self` (encrypted index), making tag write-perimeters on `self`
 * non-enforceable there by design (§4.8.4′).
 */
export declare function coversOperation(scopes: readonly string[], zone: Sphere, op: EthosOp, section: SectionRef): boolean;
/**
 * §3.5.7′ — is the holder a recipient of `section` of `zone`? True iff it holds
 * a read-bearing verb (read/edit/append/write) on `zone` whose selector matches.
 */
export declare function coversRead(scopes: readonly string[], zone: Sphere, section: SectionRef): boolean;
/**
 * Whether the scope set has ANY read-bearing ethos scope on `zone` (selector
 * ignored). Used to pre-filter delegate grants before per-section matching.
 */
export declare function hasReadBearingEthosScopeForZone(scopes: readonly string[], zone: Sphere): boolean;
/** Whether `s` is a mutating ethos scope (edit/append/delete/write on a concrete
 *  zone) — used to require `grantee.pubkey` and an actor_sphere match at mint. */
export declare function isEthosMutatingScope(s: string): boolean;
/** Whether the scope set carries any mutating ethos scope. */
export declare function hasEthosMutatingScope(scopes: readonly string[]): boolean;