/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * The session's collection-encryption descriptor policy, bound once to the app's
 * collection registry and its two seed stores (the connected session's and the
 * anonymous replica's). It owns where a descriptor comes from at each point of a
 * bring-up: minted locally at an anonymous collection's birth, read from the
 * offline cache before any remote exists, completed with live reads for a
 * granted private collection the cache does not cover, and written back to the
 * cache once the sync bootstrap has fetched a fresh set. The auth store merely
 * sequences these four operations.
 *
 * Every operation is best-effort in the same way: a failure leaves the affected
 * collections fail-closed (epoch-from-birth has no single-key fallback) and is
 * warned about, rather than failing the session.
 */
import type { CollectionEncryption } from '@interop/was-client';
import { type WasCollectionConfig } from '../config.js';
import type { IdentityAgents } from '../identity/agents.js';
import { type SeedStore } from '../identity/seedStore.js';
import type { ParsedGrants } from '../grants.js';
/**
 * The four descriptor operations, bound to one app's collections and stores.
 */
export interface DescriptorManager {
    loadOrMintAnonDescriptors(identity: IdentityAgents): Promise<Record<string, CollectionEncryption>>;
    loadCachedDescriptors(options: {
        controllerDid: string;
    }): Promise<Record<string, CollectionEncryption> | undefined>;
    cacheDescriptors(options: {
        descriptors: Record<string, CollectionEncryption>;
        controllerDid: string;
    }): Promise<void>;
    completeDescriptors(options: {
        cached?: Record<string, CollectionEncryption>;
        identity: IdentityAgents;
        parsed: ParsedGrants;
    }): Promise<{
        descriptors?: Record<string, CollectionEncryption>;
        fresh: Record<string, CollectionEncryption>;
    }>;
}
/**
 * Builds the descriptor manager for one app session.
 *
 * @param options {object}
 * @param options.collections {WasCollectionConfig[]}   the app-owned collection
 *   registry (public collections carry no descriptor)
 * @param options.sessionStore {SeedStore}   the connected session's persistence,
 *   holding the offline descriptor cache
 * @param options.anonStore {SeedStore}   the anonymous replica's persistence,
 *   holding the descriptors minted at local birth
 * @returns {DescriptorManager}
 */
export declare function createDescriptorManager({ collections, sessionStore, anonStore }: {
    collections: WasCollectionConfig[];
    sessionStore: SeedStore;
    anonStore: SeedStore;
}): DescriptorManager;
//# sourceMappingURL=descriptorManager.d.ts.map