import type { Database } from '../db/types.js';
export declare const DEFAULT_ACCESS_TOKEN_TTL_SECONDS: number;
export declare const MAX_ACCESS_TOKEN_TTL_SECONDS: number;
export type RootAccessGrant = {
    kind: 'root';
    scopes: ['**'];
};
export type ScopedAccessGrant = {
    kind: 'scoped';
    name: string;
    scopes: string[];
    expiresAt: number;
};
export type AccessGrant = RootAccessGrant | ScopedAccessGrant;
/**
 * A scope is `**`, an exact resource path, or an explicit namespace ending in
 * `/**`. Exact and descendant access are intentionally distinct.
 */
export declare function normalizeResourceScope(scope: string): string;
export declare function normalizeResourceScopes(scopes: string[]): string[];
export declare function normalizeTokenName(name: string): string;
export declare function scopeAllowsResource(scope: string, resourcePath: string): boolean;
export declare function scopesAllowResource(scopes: string[], resourcePath: string): boolean;
export declare function scopeContainsScope(parent: string, child: string): boolean;
export declare function scopesContainScopes(parents: string[], children: string[]): boolean;
export declare function assertConnectionAccess(grant: AccessGrant, path: string): void;
export declare function assertNamespaceAccess(grant: AccessGrant, namespace: string): void;
export declare function assertCanDelegate(grant: AccessGrant, name: string, scopes: string[], expiresAt: number): string[];
export declare function assertRootAccess(grant: AccessGrant): void;
export declare function mintAccessToken(rootApiKey: string, input: {
    name: string;
    scopes: string[];
    expiresIn: number;
}, now?: number): Promise<{
    token: string;
    tokenIdHash: string;
    name: string;
    scopes: string[];
    expiresAt: number;
}>;
export declare function verifyAccessToken(rootApiKey: string, token: string, now?: number): Promise<ScopedAccessGrant & {
    tokenIdHash: string;
}>;
/**
 * A valid signature proves the token was minted by this broker. The persisted
 * record remains authoritative so revocation, scope narrowing, and shortened
 * expiration take effect on the next request.
 */
export declare function authenticateAccessToken(db: Database, rootApiKey: string, token: string, now?: number): Promise<ScopedAccessGrant>;
//# sourceMappingURL=access-token.d.ts.map