import type { Client } from "@libsql/client";
import type { MeshRow } from "../../registry/meshes-repo.js";
import { type VaultRow, type VaultSource } from "../../registry/repo.js";
import { type DestinationPolicyRecordV1, type DestinationPolicyState, type DestinationPolicyValue, type DestinationSubjectKind, type EffectiveOwnedDestination } from "../../registry/destination-policy.js";
export interface DestinationPolicyContext {
    podRid: string | null;
    podIdentityStatus?: "resolved" | "missing" | "ambiguous";
    podRoot?: string;
    winners: ReadonlyMap<string, DestinationPolicyRecordV1>;
}
export interface DestinationPolicySubjectRef {
    subjectKind: DestinationSubjectKind;
    subjectRid: string;
}
export interface CanonicalVaultPublicationAuthority {
    destination: Extract<EffectiveOwnedDestination, {
        kind: "github";
    }> & {
        repositoryName: string;
    };
    policyEpoch: number;
    policySubject: DestinationPolicySubjectRef;
    guardedSubjects: readonly DestinationPolicySubjectRef[];
}
export type CanonicalVaultDestinationAssessment = Readonly<{
    status: "resolved";
    destination: EffectiveOwnedDestination;
    source: "vault-policy" | "mesh-policy";
}> | Readonly<{
    status: "refused";
    reason: "missing-policy" | "contradictory-policy" | "ambiguous-authority";
    policySource: string | null;
}>;
export interface LoadDestinationPolicyContextOptions {
    podRid?: string;
    podRoot?: string;
}
export declare function loadDestinationPolicyContext(db: Client, options?: LoadDestinationPolicyContextOptions): Promise<DestinationPolicyContext>;
export declare function resolveCanonicalOwnedVaultDestination(vault: VaultRow, mesh: MeshRow | null | undefined, context: DestinationPolicyContext): EffectiveOwnedDestination;
export declare function resolveCanonicalOwnedVaultPublicationAuthority(vault: VaultRow, mesh: MeshRow | null | undefined, context: DestinationPolicyContext): CanonicalVaultPublicationAuthority | null;
export declare function assessCanonicalOwnedVaultDestination(vault: VaultRow, mesh: MeshRow | null | undefined, context: DestinationPolicyContext, _observedOriginUrl?: string | null): CanonicalVaultDestinationAssessment;
export declare function resolveCanonicalOwnedMeshDestination(mesh: MeshRow | null | undefined, context: DestinationPolicyContext): EffectiveOwnedDestination;
export interface SetCanonicalDestinationPolicyArgs extends DestinationPolicyValue {
    subjectKind: DestinationSubjectKind;
    subjectRid: Uint8Array;
    state?: DestinationPolicyState;
    podRid?: string;
    podRoot?: string;
    writerVersion?: string;
    recordedAt?: string;
    policyEpoch?: number;
}
export declare function setCanonicalDestinationPolicy(db: Client, args: SetCanonicalDestinationPolicyArgs): Promise<DestinationPolicyRecordV1>;
export declare function backfillCanonicalOwnedVaultPolicySnapshots(db: Client, options?: LoadDestinationPolicyContextOptions): Promise<number>;
export declare function tombstoneCanonicalVaultDestination(db: Client, subjectRid: Uint8Array): Promise<boolean>;
export declare function transitionVaultSourceWithPolicyFence(db: Client, subjectRid: Uint8Array, source: VaultSource): Promise<void>;
export declare function withDestinationPolicySubjectLocks<T>(podRoot: string | undefined, subjects: readonly DestinationPolicySubjectRef[], action: (lease: DestinationPolicySubjectLockLease) => T): T;
export interface DestinationPolicySubjectLockLease {
    renew(): void;
}
//# sourceMappingURL=destination-policy-service.d.ts.map