import type { StoredDelegateKeys } from "../key-store.js";
import { type Signer } from "./signer.js";
/**
 * One active delegate session. Lives in {@link DelegateRegistry}'s
 * map keyed by `mandateId`.
 */
export declare class DelegateActor {
    #private;
    readonly subjectDid: string;
    readonly mandateId: string;
    readonly granteeId: string;
    readonly granteePubkeyMultibase: string;
    /** Full §4.2 SignedMandate, opaque JSON object. */
    readonly mandate: Record<string, unknown>;
    readonly signer: Signer;
    constructor(args: {
        subjectDid: string;
        mandateId: string;
        granteeId: string;
        granteePubkeyMultibase: string;
        mandate: Record<string, unknown>;
        signer: Signer;
    });
    /** Build from the persisted KeyStore shape. */
    static fromStored(stored: StoredDelegateKeys): DelegateActor;
    destroy(): void;
    get destroyed(): boolean;
}
/**
 * Map of active delegate sessions, keyed by `mandateId`. Provides
 * lookup helpers used by the auth namespace and (later) by `sdk.ethos`.
 */
export declare class DelegateRegistry {
    #private;
    add(actor: DelegateActor): void;
    remove(mandateId: string): void;
    get(mandateId: string): DelegateActor | undefined;
    /** Find the BEST actor for `did` — see {@link pickDelegateActor}. */
    findForSubject(did: string): DelegateActor | undefined;
    list(): readonly DelegateActor[];
    size(): number;
    /** Zeroize every actor's signer and clear the registry. */
    destroy(): void;
}
/**
 * Pick the delegate to act under when SEVERAL mandates for the same subject
 * live in the session (a keystore accumulates every imported bundle):
 *
 *   1. prefer actors whose mandate is NOT expired (`not_after` in the future;
 *      an unparseable/absent not_after is treated as not-expired),
 *   2. then the most recently ISSUED (`issued_at` desc — signed by the owner,
 *      so it is the reliable "newest grant" signal),
 *   3. then the most recently imported (registry insertion order).
 *
 * Without this, the registry returned the FIRST imported actor — so a stale
 * (revoked / never-sealed / expired) bundle lingering from earlier tests
 * silently shadowed the fresh grant the user just imported: titles rendered
 * (clear circle index) but nothing decrypted and the server denied the reads.
 */
export declare function pickDelegateActor(candidates: readonly DelegateActor[], now?: Date): DelegateActor | undefined;
//# sourceMappingURL=delegate-state.d.ts.map