import { type PutRulesOptions, type SessionPermissionRules, type SessionPolicyStore, type SessionRulesRecord, type StoredSessionRules } from "../../core/session-policy-store.js";
/**
 * design/99 §E6 — file-backed {@link SessionPolicyStore} for the local (TOC) backend: ONE JSON file per
 * `(sessionId, principal)`, semantics **byte-for-byte identical to `InMemorySessionPolicyStore`** (the
 * cross-backend equivalence contract). CAS-rev OCC + tighten-only reuse the SAME pure helpers
 * (`loosenReasons`/`normalizeRules`/`stripRev`) as core — no re-implemented rule logic that could drift.
 *
 * Atomicity: the file backend is single-process (the `FileStorageBackend` boot lock guarantees ONE writer per
 * data dir), and `getRules`/`putRules` read-check-write SYNCHRONOUSLY (no await between the rev read and the
 * atomic write), so the read-modify-write is atomic in the one event loop — exactly the InMemory store's premise.
 * Cross-process CORRECT concurrency is the Pg/TiDB backend's job (a CAS WHERE clause), by design.
 */
export declare class FileSessionPolicyStore implements SessionPolicyStore {
    private readonly dir;
    constructor(root: string);
    /** `(sessionId, principal)` → a safe, INJECTIVE filename (sanitizeScope appends the full sha256 of the raw
     *  composite key, so distinct keys never collide on disk). */
    private pathFor;
    private read;
    getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
    putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
    listBySession(sessionId: string): Promise<SessionRulesRecord[]>;
}
//# sourceMappingURL=session-policy-store.d.ts.map