import { CotalEndpoint } from "@cotal-ai/core";
import { type Connection } from "@cotal-ai/workspace";
/**
 * A one-shot, write-capable connection for the headless commands that touch the live mesh
 * (`dm`/`msg`/`ask`, and `personas list --running`). Resolution + creds + reachability all go through
 * the shared `connectOrExit` (so these work from any directory, and an explicit `--creds` is a raw
 * off-registry connection). Opens a transient endpoint that never joins the roster, does the one
 * thing, stops. USER-mode meshes ride the same call: `connectOrExit` hands back bearer + sentinel
 * and {@link endpointAuth} spreads whichever material arrived.
 */
export interface ConnectValues {
    space?: string;
    server?: string;
    creds?: string;
}
/** Resolve where to connect + with what credentials (`--creds` → raw off-registry; user-auth mesh →
 *  login/bearer material; else the running mesh's minted least-privilege OPERATOR creds — self-scoped
 *  publish + presence/channel read, no broad manager). Fail-loud — an unresolved registry or an
 *  unreachable/auth-mismatched broker exits with one sentence, never degrades. */
export declare function resolveConnect(values: ConnectValues): Promise<Connection>;
/** Open a transient endpoint: it holds the roster and channel registry on return but never registers
 *  itself, binds no inbox, and consumes no channels. The caller stops it. Static and open credentials
 *  read both buckets once, leaving no watch consumer behind. A user bearer has no batched Direct Get
 *  row, so it watches them and waits for the presence replay; its consumer lasts until the broker's
 *  inactive threshold. `watch` keeps both watches for every credential, for a caller that reports
 *  the watch's own state (`cotal who`); that caller waits for the presence replay itself, on its own
 *  bound. `throwOnRefusal` hands connection refusals to the command kernel, and `report` takes
 *  endpoint errors and warnings instead of printing them. A credential the broker will not let read
 *  a bucket once is refused with `PERMISSION_DENIED`. */
export declare function openTransient(values: ConnectValues, name: string, opts?: {
    throwOnRefusal?: boolean;
    watch?: boolean;
    report?: (level: "error" | "warning", e: Error) => void;
}): Promise<{
    ep: CotalEndpoint;
    space: string;
    connection: Connection;
}>;
//# sourceMappingURL=transient.d.ts.map