import type { PoolQueryClient } from "../../generated/storage-kit/query.js";
export declare const RUNNER_KEY_APP = "loops";
export declare const RUNNER_KEY_TOKEN_KIND = "machine";
export declare const RUNNER_KEY_CREATED_BY = "provision-runner-key";
export declare const RUNNER_KEY_DEFAULT_ROLES: readonly ["worker", "service"];
export declare const RUNNER_KEY_DEFAULT_SCOPES: readonly ["loops:runner"];
/** 365 days. */
export declare const RUNNER_KEY_DEFAULT_TTL_SECONDS = 31536000;
export interface ProvisionRunnerKeyOptions {
    /** Principal id — the runner's machine id (hostname). Never a `cloud-runner-*` alias. */
    runnerId: string;
    /** Tenant the runner belongs to. Validated with the contracts tenant grammar. */
    tenantId: string;
    /** Membership roles; runner routes require `worker` and/or `service`. */
    roles: readonly string[];
    /** Key scopes; runner routes require `loops:runner`. */
    scopes: readonly string[];
    /** Token lifetime in seconds (positive integer). */
    ttlSeconds: number;
    /** HMAC signing secret — the same `HASNA_LOOPS_API_SIGNING_KEY` the server verifies with. */
    signingSecret: string;
    /** Epoch-milliseconds override for deterministic issuance (tests). */
    nowMs?: number;
    /** Key-id override (tests / deterministic reissue). */
    kid?: string;
    /**
     * Called with the minted token INSIDE the transaction, after the key row is
     * inserted and before commit. A delivery failure therefore rolls the mint
     * back — a committed key whose plaintext was never delivered is
     * unrecoverable (only the hash is stored) and the idempotency check would
     * otherwise refuse a re-run forever. Never invoked on the
     * `already_provisioned` path. The caller remains responsible for never
     * printing the token into transcripts.
     */
    deliverToken?: (token: string) => void;
}
export type ProvisionRunnerKeyOutcome = {
    status: "provisioned";
    runnerId: string;
    kid: string;
    expiresAt: string;
    /** The minted token — returned once, never logged by this module. */
    token: string;
} | {
    status: "already_provisioned";
    runnerId: string;
    kid: string;
    expiresAt: string | null;
};
/**
 * Provision (or confirm) the runner's machine principal and machine-kind API
 * key. Idempotent: with an active machine principal and an active unexpired
 * machine-kind key present, returns `already_provisioned` without minting.
 */
export declare function provisionRunnerKey(client: PoolQueryClient, options: ProvisionRunnerKeyOptions): Promise<ProvisionRunnerKeyOutcome>;