import type { VerifyTokenHook } from '@kokuin/capability';
import type { DIDMethodResolver, Identity } from '@kokuin/token';
import type { StoreProvider } from '@kubun/db';
import { KubunDB } from '@kubun/db';
import type { DeployGraphParams, DeployGraphResult, DocumentMutation, DocumentNode, ExecuteGraphResult, ListGraphResult, LoadGraphParams, LoadGraphResult } from '@kubun/protocol';
import type { GraphStoreAPI } from '@kubun/store-graph';
import type { GraphQLSchema } from 'graphql';
import type { DefaultAccessLevel } from './access-control.js';
import type { EngineEvents } from './engine-events.js';
import type { ApplyVerifiedMutationResult, ContextFactory, EngineParams, MutateDocumentsParams } from './engine-types.js';
import { EngineEventBus } from './events.js';
import type { Engine, EngineGraphParams, GraphQLSource, GraphQLSourceParams } from './executor.js';
import type { ConsultOptions, Provider } from './providers.js';
/** Until measured: a week for an edit or a hold to bring a document back into use. */
export declare const DEFAULT_GC_GRACE_MS: number;
/**
 * Build a write-access checker closure bound to a graph store. When provided,
 * `extraTokensByIssuer` supplies additional delegation tokens held locally for
 * a given issuer DID; they are unioned with the mutation's inline `cap` so
 * server-side application can authorize a write whose held credentials live in
 * the receiving peer's p2p store rather than on the wire.
 *
 * Exported (without `#`) so unit tests can construct the checker with a
 * hand-built map and exercise the union math directly. The Engine method
 * `#buildWriteAccessChecker` delegates to this helper.
 */
export declare function buildWriteAccessChecker(params: {
    store: GraphStoreAPI;
    defaultAccessLevel: DefaultAccessLevel;
    permissionType?: 'write' | 'share';
    extraTokensByIssuer?: Map<string, Array<string>>;
    revocationChecker?: VerifyTokenHook;
    controllerResolver?: DIDMethodResolver;
}): (doc: DocumentNode, mutation: DocumentMutation) => Promise<boolean>;
export type { Engine };
export declare class KubunEngine implements Engine {
    #private;
    getGraphQLSchema(id: string): Promise<GraphQLSchema>;
    listGraphs(): Promise<ListGraphResult>;
    loadGraph(params: LoadGraphParams): Promise<LoadGraphResult>;
    deployGraph(params: DeployGraphParams): Promise<DeployGraphResult>;
    fetchControllerHeadOnline(did: string, stores?: StoreProvider): Promise<import("./controller-log-resolver.js").ControllerHeadOnlineResult>;
    constructor(params: EngineParams);
    /**
     * Verify the database's sealed identity, opening the HLC mint gate on success.
     * Memoized and idempotent: the first call runs the anchor CAS on the bare
     * connection; every later call — including the nested `await` inside an
     * already-open write transaction — awaits the same settled promise and never
     * touches the connection, so it cannot deadlock single-connection SQLite.
     *
     * A rejection (identity mismatch, outdated controller store) is memoized and
     * therefore terminal for this engine instance: recovery is to dispose and
     * reconstruct.
     */
    ready(): Promise<void>;
    get did(): string;
    get identity(): Identity;
    get eventBus(): EngineEventBus<EngineEvents>;
    /**
     * The engine's underlying database. Exposed so a caller that handed in a
     * shared `KubunDB` (which `dispose()` deliberately leaves open) can close it
     * during its own teardown. When the engine created the db from a raw adapter,
     * `dispose()` closes it and this handle is not needed.
     */
    get db(): KubunDB;
    /**
     * Dispose the engine by shutting down all plugins in reverse registration order.
     * Second and subsequent calls are no-ops. Each plugin's disposal failure is
     * logged but does not prevent remaining plugins from being disposed.
     */
    dispose(): Promise<void>;
    /**
     * Return a GraphQLSource bound to a specific graph (and optionally a viewer).
     * The returned object delegates query/mutate/subscribe to the engine, injecting
     * the graphID and viewerDID from the source params on each call.
     */
    getGraphQLSource(params: GraphQLSourceParams): GraphQLSource;
    /**
     * Register a context factory that contributes per-request fields flatly to
     * the GraphQL execution context. Escape hatch for test fixtures — not
     * subject to the plugin-namespace collision check. Prefer `KubunPlugin`'s
     * `createContextFactory` for plugin-scoped, namespaced contributions.
     */
    registerContextFactory(factory: ContextFactory): void;
    queryGraph<Data extends Record<string, unknown> = Record<string, unknown>>(params: EngineGraphParams): Promise<ExecuteGraphResult<Data>>;
    mutateGraph<Data extends Record<string, unknown> = Record<string, unknown>>(params: EngineGraphParams): Promise<ExecuteGraphResult<Data>>;
    /**
     * Apply a batch of document writes signed by this engine's identity, all
     * within a single signed write transaction. Unlike `mutateGraph` this does not
     * parse or execute any GraphQL text — writes are driven directly onto the
     * mutation operations. Returns the applied result for each write, in order.
     */
    mutateDocuments(params: MutateDocumentsParams): Promise<Array<ApplyVerifiedMutationResult>>;
    subscribeToGraph<Data extends Record<string, unknown> = Record<string, unknown>>(params: EngineGraphParams): Promise<AsyncGenerator<ExecuteGraphResult<Data>> | ExecuteGraphResult<Data>>;
    getAPI<T extends Record<string, unknown> = Record<string, unknown>>(name: string): Promise<T>;
    getProviders<Impl extends Record<string, unknown> = Record<string, unknown>>(kind: string): Promise<Array<Provider<Impl>>>;
    getProvidersSync<Impl extends Record<string, unknown> = Record<string, unknown>>(kind: string): Array<Provider<Impl>>;
    getProvider<Impl extends Record<string, unknown> = Record<string, unknown>>(kind: string): Promise<Provider<Impl> | undefined>;
    /**
     * Consult the providers of an ordered `kind` in tier/priority order, returning
     * the first defined result. Local providers are invoked directly; remote
     * providers are timeout-wrapped and fall through on error or timeout. This is
     * where the "local preferred, remote failover" invariant lives.
     *
     * A caller's `isFatal` may promote a throw to abort-and-re-throw. Every
     * fall-through error is logged at `warn` through the engine logger — a caught
     * throw is abnormal even when failover recovers it, so it must never be
     * silent. A caller-supplied `onError` still runs after the log.
     */
    consultProviders<Impl extends Record<string, unknown>, R>(kind: string, invoke: (provider: Provider<Impl>) => Promise<R | undefined>, opts?: ConsultOptions): Promise<R | undefined>;
}