import { SmrtCollection } from '@happyvertical/smrt-core';
import { FieldPolicy } from '../models/FieldPolicy.js';
import type { FieldPolicyAuditSnapshot, FieldPolicyBatchResult, FieldPolicyEditorStateResult } from '../types.js';
/** Public cap shared by the server catalog and browser adapter. */
export declare const MAX_FIELD_POLICY_AUDIT_OBJECT_REFS = 100;
/** Count queries are projected, so they can cover a page plus an off-page selection. */
export declare const MAX_FIELD_POLICY_AUDIT_COUNT_REFS: number;
/**
 * Collection surface for {@link FieldPolicy} rows plus the batch resolve
 * action consumed by client bootstrapping (#2048).
 *
 * `resolveBatch` is a custom collection-scoped action (NOT a system route —
 * core's generated system trio is closed): the generated route parses the
 * body, calls the method on the app-configured collection instance (which
 * carries the app database), and serializes the plain result.
 *
 * Exposure note: a decorated collection's config becomes the RUNTIME registry
 * authority for its item class (core merges the collection registration onto
 * the item slot), while build-time generation reads each manifest object's
 * own config. This config therefore mirrors FieldPolicy's API posture —
 * writes open plus the batch action, reads CLOSED (generated list/get would
 * enumerate every tenant's/user's rows) — and closes the runtime CLI/MCP
 * surfaces entirely (the ContentContributions precedent; the cli↔api
 * coherence gate does not admit standard CRUD entries on a collection's
 * `cli.include`). Keep the api include lists in lockstep with FieldPolicy's.
 */
export declare class FieldPolicyCollection extends SmrtCollection<FieldPolicy> {
    static readonly _itemClass: typeof FieldPolicy;
    /**
     * Permission-gated, tenant-scoped audit read for the defaults control
     * panel. It returns editable own-tenant rows, read-only app summaries,
     * projected user override counts, and identity-only manifest drift rows.
     */
    policyAudit(options?: {
        objectRefs?: string[];
        countObjectRefs?: string[];
        /** Capability-only bootstrap for catalog builders before page selection. */
        summaryOnly?: boolean;
        /** Return row/count roll-ups without resolving field-policy layers. */
        countsOnly?: boolean;
        /** Return the first bounded page of manifest drift candidates. */
        includeDrift?: boolean;
    }): Promise<FieldPolicyAuditSnapshot>;
    private resolveAuditPolicies;
    /** All app-scope rows for an object, keyed by field name. */
    getAppRows(objectRef: string): Promise<Map<string, FieldPolicy>>;
    /**
     * All tenant-scope rows for an object across a tenant chain, keyed
     * `tenantId → fieldName → row`.
     */
    getTenantRows(objectRef: string, tenantIds: string[]): Promise<Map<string, Map<string, FieldPolicy>>>;
    /** All user-scope rows for an object and user, keyed by field name. */
    getUserRows(objectRef: string, userId: string): Promise<Map<string, FieldPolicy>>;
    /**
     * Resolve merged field policy for a set of objectRefs for the CURRENT
     * caller, gated for public consumption.
     *
     * Caller identity comes exclusively from the ambient tenant context
     * (established by the app's auth hook, e.g. smrt-users' session context) —
     * the request body cannot select another tenant or user (fail closed).
     * Server-side consumers wanting explicit identities call
     * `resolveFieldPolicy()` directly instead.
     *
     * Field gating mirrors the REST serializer's derivation (`sensitive` /
     * `readPermission` read from both the top level and `_meta`): sensitive and
     * read-permission-gated fields are ABSENT from the response for every
     * caller (the generated action route cannot convey per-caller grants to
     * this method, so gated fields fail closed), and transient fields are
     * stripped for parity with generated client field definitions.
     */
    resolveBatch(options?: {
        objectRefs?: string[];
    }): Promise<FieldPolicyBatchResult>;
    /**
     * Context-derived bootstrap data for the policy gear. This is deliberately
     * a collection action instead of reopening list/get: a caller can inspect
     * only their safe effective policy and rows/layers they are permitted to
     * edit, never arbitrary tenant or user policy rows.
     */
    getEditorState(options?: {
        objectRef?: string;
    }): Promise<FieldPolicyEditorStateResult>;
    /**
     * Compute the non-disclosing fallback signal used only by personal drafts.
     * Passing no user id resolves exactly code/app/tenant precedence, including
     * the real tenant hierarchy, while keeping every lower-layer value server
     * side. The public map is limited to fields already admitted by the editor
     * response's security rail.
     */
    private getPersonalLowerDefaultUsability;
    private gateResolvedForPublicResponse;
    private gateExplainedForEditorResponse;
    private toEditorRows;
}
//# sourceMappingURL=FieldPolicyCollection.d.ts.map