import type { H3Event } from "h3";
import { type DbExec } from "../db/client.js";
declare const TOKEN_KIND = "agent-native-embed-session";
declare const EMBED_CAPABILITY_SCOPE_PREFIX = "capability:";
export interface EmbedSessionTicketInput {
    ownerEmail: string;
    /** Full HTTP(S) origin, including non-default ports; hostname-only audiences are refused. */
    audienceHost?: string;
    orgId?: string | null;
    targetPath: string;
    scope?: string | null;
    ttlSeconds?: number;
    renewalExpiresAtMs?: number;
    revocationAnchorCreatedAtMs?: number;
}
export interface EmbedSessionTicket {
    ticket: string;
    ticketHash: string;
    expiresAt: number;
}
export interface McpDirectoryWidgetRenewalTicket {
    sessionId: string;
    ownerEmail: string;
    orgId?: string;
    targetPath: string;
    scope: string;
    createdAtMs: number;
    expiresAtMs: number;
    consumedAtMs: number | null;
    renewalExpiresAtMs: number;
    sessionActiveUntilMs: number | null;
}
export type EmbedSessionTicketConsumeOutcome = "missing-ticket" | "not-found" | "already-consumed" | "expired" | "identity-mismatch" | "org-mismatch" | "audience-mismatch" | "consumption-race" | "invalid-row" | "revoked" | "consumed";
export interface EmbedSessionTicketConsumeDiagnostic {
    outcome: EmbedSessionTicketConsumeOutcome;
    ticketKey: string | null;
    ticketRowFound: boolean;
    consumed: boolean;
    expired: boolean;
    expectedOwnerKey: string | null;
    ticketOwnerKey: string | null;
    expectedOrgKey: string | null;
    ticketOrgKey: string | null;
}
export interface ConsumeEmbedSessionTicketOptions {
    audienceHost?: string;
    expectedOwnerEmail?: string | null;
    expectedOrgId?: string | null;
    allowCapabilityIdentityMismatch?: boolean;
    onResult?: (result: EmbedSessionTicketConsumeDiagnostic) => void;
}
export interface ConsumedEmbedSessionTicket {
    ownerEmail: string;
    orgId?: string;
    targetPath: string;
    scope?: string;
    expiresAt: number;
    ticketCreatedAtMs: number;
    sessionId?: string;
}
export interface EmbedSessionTokenClaims {
    kind: typeof TOKEN_KIND;
    ownerEmail: string;
    orgId?: string;
    targetPath: string;
    audienceHost?: string;
    audienceBasePath?: string;
    scope?: string;
    iat: number;
    issuedAtMs?: number;
    ticketCreatedAtMs?: number;
    sessionId?: string;
    exp: number;
}
export type VerifyEmbedSessionTokenResult = {
    ok: true;
    claims: EmbedSessionTokenClaims;
} | {
    ok: false;
    reason: string;
};
export type ResolvedEmbedSession = {
    email: string;
    orgId?: string;
    token: string;
    targetPath: string;
    scope?: string;
};
export declare function isEmbedCapabilityScope(scope: string | undefined | null): scope is `${typeof EMBED_CAPABILITY_SCOPE_PREFIX}${string}`;
export declare function resolvedEmbedCapabilityScope(session: ResolvedEmbedSession | null): string | undefined;
export declare const embedSessionsStore: import("../db/store-registry.js").Store;
export declare function ensureTable(): Promise<void>;
export declare function revokeEmbedSessionsForOwner(ownerEmail: string): Promise<void>;
export declare function revokeEmbedSessionsForOwners(ownerEmails: string[], inTransaction?: (tx: DbExec) => Promise<void>): Promise<void>;
export declare function requestMatchesEmbedTarget(event: H3Event, targetPath: string): boolean;
export declare function normalizeEmbedTargetPath(raw: string | undefined | null, requestOrigin?: string): string | null;
export declare function createEmbedSessionTicket(input: EmbedSessionTicketInput): Promise<EmbedSessionTicket>;
export declare function readMcpDirectoryWidgetRenewalTicket(ticket: string, options?: {
    audienceHost?: string;
}): Promise<McpDirectoryWidgetRenewalTicket | null>;
export declare function renewMcpDirectoryWidgetSession(input: {
    audienceHost?: string;
    sourceTicket: string;
    ownerEmail: string;
    orgId?: string | null;
    expectedScope: string;
    renewedScope: string;
}): Promise<number | null>;
export declare function resolveEmbedSessionTokenForOrigin(token: string | undefined, origin: string): Promise<EmbedSessionTokenClaims | null>;
export declare function isExpiredMcpDirectoryWidgetSessionRequest(event: H3Event): Promise<boolean>;
export declare function resolveEmbedSessionCookieOwners(tokens: string[]): Promise<string[]>;
export declare function consumeEmbedSessionTicket(ticket: string | undefined | null, options?: ConsumeEmbedSessionTicketOptions): Promise<ConsumedEmbedSessionTicket | null>;
export declare function signEmbedSessionToken(input: {
    ownerEmail: string;
    orgId?: string | null;
    targetPath: string;
    /** Full HTTP(S) origin; an unbound token cannot authenticate a request. */
    audienceHost?: string;
    scope?: string | null;
    ticketCreatedAtMs?: number;
    sessionId?: string;
    ttlSeconds?: number;
}): string;
export declare function verifyEmbedSessionToken(token: string | undefined | null, options?: {
    allowExpired?: boolean;
}): VerifyEmbedSessionTokenResult;
export declare function setEmbedSessionCookie(event: H3Event, token: string): void;
export declare function resolveEmbedSessionFromRequest(event: H3Event): Promise<ResolvedEmbedSession | null>;
export declare function hasExplicitEmbedSessionCredential(event: H3Event): boolean;
export declare function hasEmbedSessionRequestMarker(event: H3Event): boolean;
export declare function hasPresentedEmbedSessionCredential(event: H3Event): boolean;
export declare function hasLiveEmbedCapabilityCookie(event: H3Event): boolean;
export declare function requestHasEmbedAuthMarker(event: H3Event): boolean;
export declare function isEmbedModeRequest(event: H3Event): boolean;
export {};