/**
 * Run admission (SPEC 14.8): the immutable, manager-owned record of WHAT AUTHORITY a hosted
 * workflow run was admitted under, beside the independent marker that revokes it.
 *
 * A hosted run acts on channels through the trusted mediator, whose credential is host-wide. The
 * admission record is what confines that: it snapshots, at `run-start`, the caller's ISSUED
 * ceiling (SPEC 13.15) as the run's channel ceiling, and every channel effect the host performs
 * afterwards is checked against it. The record is created once, create-only, by a one-shot
 * `run-admitter` credential the manager mints per run; the driver holds no grant on this store;
 * the mediator reads it leader-served before each effect.
 *
 * Revocation is a SEPARATE create-only marker under its own key, so absence of revocation is a
 * readable "no marker" on a store the reader can reach, never a missing record on a store it
 * cannot. A failed read on either key is a refusal, not an absence.
 *
 * The store is its own bucket (`cotal_admission_<space>`, `allow_direct=false`): the driver-writable
 * run/program/journal records and the registration-policy records are the wrong place for a
 * record whose whole point is that the driver cannot influence it.
 */
import type { JetStreamManager } from "@nats-io/jetstream";
import type { KV, Kvm } from "@nats-io/kv";
import { EpEnvelopeError } from "./endpoint-envelope.js";
import { type EpCaller } from "./endpoint-subjects.js";
import { type IssuedAuthorityRef, type IssuedSubjectPermissions } from "./issued-authority.js";
export declare function admissionBucket(space: string): string;
export declare function admissionKey(endpoint: string, runId: string): string;
export declare function revocationKey(endpoint: string, runId: string): string;
/** Where a run's authority came from. `issued` is the only shape a served `run-start` admits;
 *  `operator` is a local drive or an explicit migration, admitted from trusted operator evidence
 *  the operator names, never inferred from program text. */
export type RunAdmissionProvenance = {
    readonly kind: "issued";
    readonly ref: IssuedAuthorityRef;
    readonly resolvedRevision: number;
} | {
    readonly kind: "operator";
    readonly by: string;
    readonly reason: string;
};
export interface RunAdmission {
    readonly version: 1;
    readonly space: string;
    readonly endpoint: string;
    readonly runId: string;
    /** The admitting manager instance. */
    readonly instanceId: string;
    /** The caller the run was admitted for: the issued triple, or the operator's principal. */
    readonly caller: EpCaller;
    /** The channel ceiling the run's effects are checked against: the caller's issued publish and
     *  subscribe ceilings, verbatim. Explicit `none` is deny-all. */
    readonly ceiling: IssuedSubjectPermissions;
    readonly provenance: RunAdmissionProvenance;
    readonly admittedAt: number;
}
export interface RunRevocation {
    readonly version: 1;
    readonly runId: string;
    readonly reason: string;
    readonly by: string;
    readonly revokedAt: number;
}
/** Validate a record at the consuming boundary: closed schema, version, coordinates. */
export declare function admissionSnapshot(value: unknown): RunAdmission;
export declare function revocationSnapshot(value: unknown, runId: string): RunRevocation;
/** Create the admission, create-only. A second create for the same run is a conflict: a run is
 *  admitted once, and a re-admission is a new run (a fork) or an explicit migration. */
export declare function createRunAdmission(kv: KV, admission: RunAdmission): Promise<number>;
/** Create the revocation marker, create-only and idempotent on an existing marker. */
export declare function revokeRunAdmission(kv: KV, endpoint: string, revocation: RunRevocation): Promise<void>;
export interface RunAdmissionView {
    readonly admission: RunAdmission;
    readonly revoked: RunRevocation | undefined;
}
/** The admission a host acts on: the record must exist, match its coordinates, and carry no
 *  revocation marker. Missing, unreadable, malformed, mismatched, or revoked all refuse. */
export declare function readRunAdmission(jsm: JetStreamManager, space: string, endpoint: string, runId: string): Promise<RunAdmissionView>;
/**
 * The revocation marker alone, without the admission record beside it.
 *
 * {@link readRunAdmission} refuses when the admission is missing, unreadable or names other
 * coordinates, which is the only safe answer for a host about to perform a channel effect. A
 * DISPLAY surface is in a different position: it is not about to act on the record, and refusing a
 * whole listing because one row has no admission would hide every other row from the operator
 * reading it. So a reader that only needs to know "was this revoked" reads the marker key and
 * nothing else.
 *
 * A read that FAILS still throws. "No marker" and "could not look" are different answers, and a
 * caller that cannot tell them apart would render a revoked run as live the moment the store went
 * away.
 */
export declare function readRunRevocation(jsm: JetStreamManager, space: string, endpoint: string, runId: string): Promise<RunRevocation | undefined>;
/** The channel checks a host applies, over the admitted ceiling. Concrete channels only: a
 *  wildcard is not a channel a run can post to or await, and a generated name is checked after
 *  it is derived, by the same rule. */
export declare class RunAdmissionDenied extends EpEnvelopeError {
    constructor(runId: string, what: string, channel: string);
}
export declare function assertAdmittedPublish(view: RunAdmissionView, channel: string, caller: EpCaller): void;
export declare function assertAdmittedSubscribe(view: RunAdmissionView, channel: string): void;
export declare function assertNotRevoked(view: RunAdmissionView): void;
/** Create-or-verify the admission store: `allow_direct=false`, file, no eviction. */
export declare function ensureAdmissionStore(jsm: JetStreamManager, kvm: Kvm, space: string): Promise<void>;
//# sourceMappingURL=run-admission.d.ts.map