import { SmrtCollection } from '@happyvertical/smrt-core';
import { UsersCliAuthRequest } from '../models/CliAuthRequest.js';
export interface ApprovePendingCliAuthRequestInput {
    approvedBy: string;
    ipAddress?: string;
    sessionTtlSeconds: number;
    tenantId: string;
    userAgent?: string;
    userCode: string;
    userId: string;
}
export interface ApprovedCliAuthRequestSnapshot {
    approvedAt: Date;
    id: string;
    sessionId: string;
    tenantId: string;
    userId: string;
}
export declare class UsersCliAuthRequestCollection extends SmrtCollection<UsersCliAuthRequest> {
    static readonly _itemClass: typeof UsersCliAuthRequest;
    /**
     * Atomically approve one pending request and mint its bearer session.
     *
     * The session is created inside the same transaction as the conditional
     * pending-to-approved transition. If another approver wins, or persisting
     * the approval fails, throwing rolls the losing session back with the
     * request write so no usable orphan credential can remain.
     */
    approvePendingRequest(input: ApprovePendingCliAuthRequestInput): Promise<ApprovedCliAuthRequestSnapshot | null>;
    /**
     * Atomically consume the bearer session attached to an approved request.
     *
     * The conditional update is the arbiter: concurrent exchangers may observe
     * the same candidate, but only one can change `approved` to `consumed` while
     * matching the same session id. The winning transaction returns the token
     * from its locked candidate and clears it from durable storage.
     */
    consumeApprovedSession(deviceCodeHash: string): Promise<string | null>;
    /**
     * Look up a pending or completed request by the short user code shown in the CLI.
     */
    findByUserCode(userCode: string): Promise<UsersCliAuthRequest | null>;
    /**
     * Look up a request by the hash of its device code (the CLI's polling key).
     */
    findByDeviceCodeHash(deviceCodeHash: string): Promise<UsersCliAuthRequest | null>;
    /**
     * Delete expired pending, lazily-expired, or already-consumed requests.
     *
     * Scheduled by the framework retention sweep (#2375); `expiresAt` carries an
     * index for this predicate.
     *
     * @param options.dryRun - Count the requests the predicate selects without
     *   deleting them.
     * @returns Number of requests deleted (or, under `dryRun`, matched)
     */
    deleteExpired(options?: {
        dryRun?: boolean;
    }): Promise<number>;
}
export { UsersCliAuthRequestCollection as CliAuthRequestCollection };
//# sourceMappingURL=CliAuthRequestCollection.d.ts.map