import type { IdType } from '../../..';
import { BaseHelper } from '@venizia/ignis-helpers/core';
import { type TNullable } from '@venizia/ignis-helpers/common';
import { type TAuthorizationAction, type TAuthorizationDecision, type TGrantIntent, type TPlannedGrantRow } from '../common';
import { type TPolicyDomainInput } from './policy.builder';
export declare class GrantBuilder extends BaseHelper {
    static readonly SINGLETON_REAL_KEY = "grant-builder";
    /** Tiers a caller may ask for; `custom` is an encoding marker and is never a valid intent. */
    private static readonly PLANNABLE_TIERS;
    /** Tried after `manage`; disjoint from each other, since an operation has one catalogued action. */
    private static readonly NARROW_TIERS;
    constructor();
    static getInstance(): GrantBuilder;
    decodeMetadata<MetadataType = unknown>(opts: {
        metadata: MetadataType;
    }): any;
    /** Read `{ ops }` off a grant row's metadata, or null when the shape is unusable. Callers treat null as a defect to log and skip - never as an empty grant. */
    parseCustomGrantMetadata(opts: {
        metadata: unknown;
    }): {
        ops: string[];
    } | null;
    /** Split operation names into those present in the catalog for `subject` and those that are not. Pure - the caller supplies the catalog slice; the adapter re-runs this independently at read time. */
    validateCustomGrantOps(opts: {
        ops: string[];
        subject: string;
        catalog: Array<{
            subject: string;
            method: string;
        }>;
    }): {
        valid: string[];
        unknown: string[];
    };
    /** Actions a tier confers, derived from LATTICE rather than hardcoded so the two cannot drift. */
    actionsCoveredBy(opts: {
        tier: TAuthorizationAction;
    }): Set<string>;
    /** Decide which rows express an intent: a custom row is a last resort, so as much of the selection as possible collapses into tier grants first. `exact` disables collapsing when the caller means these operations and no future ones. Pure - the caller supplies the catalog and persists. */
    planGrant(opts: {
        subject: {
            type: string;
            id: IdType;
        };
        resource: {
            type: string;
            id: IdType;
            subject: string;
        };
        intent: TGrantIntent;
        catalog: Array<{
            subject: string;
            method: string;
            code: string;
            action: string;
        }>;
        domain?: TNullable<TPolicyDomainInput>;
        effect?: TAuthorizationDecision;
        supportsCustomMetadata?: boolean;
        exact?: boolean;
    }): TPlannedGrantRow[];
    /** Collapse `remaining` into the fewest tier grants, mutating `remaining` and appending to `rows`. */
    protected collapseRemainingIntoTiers(opts: {
        subjectCatalog: Array<{
            subject: string;
            method: string;
            code: string;
            action: string;
        }>;
        remaining: Set<string>;
        rows: TPlannedGrantRow[];
        tierRow: (tier: TAuthorizationAction) => TPlannedGrantRow;
    }): void;
}
//# sourceMappingURL=grant.builder.d.ts.map