import { type IntegrationClientOptions, type WritebackResult } from '@relayfile/adapter-core/vfs-client';
import type { RelayTransport, RelayTransportWriteRequest } from './transport.js';
export type RelayWriteAuthorizationDecision = {
    allowed: false;
    reason?: string;
} | {
    allowed: true;
    transport?: RelayTransport;
};
/**
 * Execution-scoped policy hook invoked once at the final helper write boundary.
 * A local runtime may deny the write or redirect it to its canonical preview
 * transport without allowing an explicitly injected transport to run.
 */
export type RelayWriteAuthorizer = (request: Readonly<RelayTransportWriteRequest>) => RelayWriteAuthorizationDecision | Promise<RelayWriteAuthorizationDecision>;
export declare class RelayWriteAuthorizationError extends Error {
    readonly code: "RELAY_WRITE_DENIED";
    readonly provider: string;
    readonly resource: string;
    constructor(request: Pick<RelayTransportWriteRequest, 'provider' | 'resource'>, reason?: string);
}
/** @internal Descriptor for the only native-VFS write sink in this package. */
export interface RelayWriteVfsFallback {
    readonly options: IntegrationClientOptions;
    readonly integration: string;
    readonly operation: string;
    readonly path: string;
    readonly data: unknown;
}
/**
 * Bind a final-write authorizer to the current asynchronous execution context.
 * Later bindings compose monotonically: any denial wins and the earliest
 * transport override remains authoritative. The idempotent restoration
 * callback is safe to call out of order and never resurrects inactive policy.
 */
export declare function bindRelayWriteAuthorizer(authorizer: RelayWriteAuthorizer): () => void;
/**
 * Run an operation in an isolated authorization scope. Use this form when a
 * process may host overlapping Runs; concurrent scopes do not observe or
 * mutate one another, while bindings created inside a scope still compose.
 */
export declare function runWithRelayWriteAuthorizer<T>(authorizer: RelayWriteAuthorizer, operation: () => T): T;
/** @internal Shared final boundary for catalog and bespoke helper writes. */
export declare function executeRelayWrite(selectedTransport: RelayTransport | undefined, request: RelayTransportWriteRequest, fallback?: RelayWriteVfsFallback): Promise<WritebackResult>;
//# sourceMappingURL=write-authorizer.d.ts.map