/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { ActionContext } from "#behavior/context/ActionContext.js";
import { OnlineEvent } from "#behavior/Events.js";
import { ObservableValue } from "@matter/general";
import { AclEndpointContext, AclEntry, AclList, Fabric, IncomingSubjectDescriptor, MessageExchange } from "@matter/protocol";
import { ClusterId, FabricIndex, SubjectId } from "@matter/types";
import { AccessControl as AccessControlTypes } from "@matter/types/clusters/access-control";
declare const AccessControlBase: import("../../index.js").ClusterBehavior.Type<import("./AccessControlBehavior.js").AccessControlBehaviorConstructor, import("@matter/types").ClusterType.WithSupportedFeatures<AccessControlTypes, {
    auxiliary: false;
    extension: true;
    managedDevice: false;
}>, import("@matter/types").ClusterType.Concrete, new () => {}, "accessControl">;
/**
 * This is the default server implementation of AccessControlBehavior.
 *
 * When custom extensions are used, the `extensionEntryValidator` and `extensionEntryAccessCheck` methods can be
 * overridden to implement custom validation and access checks for the extension entries.
 */
export declare class AccessControlServer extends AccessControlBase {
    #private;
    internal: AccessControlServer.Internal;
    readonly state: AccessControlServer.State;
    readonly events: AccessControlServer.Events;
    initialize(): void;
    addDefaultCaseAcl(fabric: Fabric, subjects: SubjectId[]): void;
    /**
     * This method allows to implement the validation of manufacturer specific ACL extensions when an extension entry is
     * added or changed. The default implementation checks whether the extension is a valid TLV and possible to decode.
     *
     * In case of an Error throws StatusResponseError.
     *
     * Override this method in your own behavior to implement custom validation.
     */
    protected extensionEntryValidator(extension: AccessControlTypes.AccessControlExtension): void;
    /**
     * This method allows to implement the validation of manufacturer specific ACL extensions when access control is
     * checked to decide if access is allowed or not.
     * The default implementation always returns true. Override this method in your own behavior to implement custom
     * validation.
     */
    protected extensionEntryAccessCheck(_aclList: AclList, _aclEntry: AclEntry, _subjectDesc: IncomingSubjectDescriptor, _endpoint: AclEndpointContext, _clusterId: ClusterId): boolean;
    /**
     * Register an observable that supplies auxiliary ACL entries. AccessControlServer subscribes to the observable
     * and rebuilds fabric ACLs whenever it emits new entries. Multiple providers are supported.
     *
     * The observable should emit `AccessControlEntry[]` (all entries for all fabrics from this provider).
     * AccessControlServer reads the current `observable.value` immediately on registration for initial sync.
     */
    registerAuxAclProvider(observable: AccessControlServer.AuxAclObservable): void;
}
export declare namespace AccessControlServer {
    class State extends AccessControlBase.State {
        /**
         * Synthesized read-only ACL entries supplied by auxiliary providers (e.g. Groupcast), split to the per-entry
         * limits.  Mirrors what access control enforces; only present when the Auxiliary feature is enabled.
         */
        auxiliaryAcl?: AccessControlTypes.AccessControlEntry[];
    }
    class Events extends AccessControlBase.Events {
        /** Emitted when auxiliary ACL entries change.  Only present when the Auxiliary feature is enabled. */
        auxiliaryAccessUpdated?: OnlineEvent<[
            payload: AccessControlTypes.AuxiliaryAccessUpdatedEvent,
            context: ActionContext
        ]>;
    }
    class Internal {
        /** Is the cluster logic initialized? Used to block events before full initialization. */
        initialized: boolean;
        /**
         * When an online and potentially chunked ACL writing happens, we will delay the update and store the exchange
         * used for the writing. With this we also verify that concurrent writes are blocked and will not mix the data.
         */
        aclUpdateDelayed: Map<FabricIndex, MessageExchange | undefined>;
        /** Latest delayed data of acl attribute */
        delayedAclData: Map<FabricIndex, AccessControlTypes.AccessControlEntry[]>;
        /** Registered observable providers that supply auxiliary ACL entries. */
        auxiliaryAclProviders: Set<AuxAclObservable>;
        /** Real ACL entries applied last per fabric; the effective ACL combines them with current auxiliary entries. */
        appliedAcl: Map<FabricIndex, AccessControlTypes.AccessControlEntry[]>;
        /** Per-entry limits, captured at initialization so auxiliary entries can be split without a state access. */
        auxiliaryEntryLimits: {
            subjects: number;
            targets: number;
        };
    }
    const ExtensionInterface: {
        extensionEntryValidator: (extension: AccessControlTypes.AccessControlExtension) => void;
        extensionEntryAccessCheck: (aclList: AclList, aclEntry: AclEntry, subjectDesc: IncomingSubjectDescriptor, endpoint: AclEndpointContext, clusterId: ClusterId) => boolean;
    };
    /**
     * An observable that supplies auxiliary ACL entries to {@link AccessControlServer}.
     * Register via {@link AccessControlServer.registerAuxAclProvider}.
     *
     * Emit `AccessControlEntry[]` (all entries across all fabrics) whenever the provider's entries change.
     * AccessControlServer subscribes and rebuilds its ACL cache automatically.
     */
    type AuxAclObservable = ObservableValue<[AccessControlTypes.AccessControlEntry[], ActionContext?]>;
}
export {};
//# sourceMappingURL=AccessControlServer.d.ts.map