/**
 * In-process auth-wait for `hq-sync-runner --watch`.
 *
 * A one-shot run still emits `auth-error` and exits. Watch mode must not:
 * the outpost launcher treats a clean exit as "restart in 10s", which
 * crash-loops discovery/subscribe against an unusable session.
 *
 * Recheck cadence is exported so tests inject a compressed clock without
 * changing production values.
 */
export declare const AUTH_WAIT_INITIAL_RECHECK_MS = 60000;
export declare const AUTH_WAIT_STEADY_RECHECK_MS: number;
export declare const AUTH_WAIT_LIVENESS_INTERVAL_MS: number;
/**
 * Twelve failed checks cover roughly one hour (the initial one-minute check,
 * then eleven five-minute checks): long enough to absorb a transient refresh
 * race, short enough to surface an abandoned device session the same hour.
 */
export declare const AUTH_WAIT_ESCALATION_FAILURE_THRESHOLD = 12;
export declare const AUTH_WAIT_START_MESSAGE = "hq-sync-runner: auth required \u2014 waiting for a valid session (rechecking every 5m)";
export declare const AUTH_WAIT_RESUME_MESSAGE = "hq-sync-runner: session restored \u2014 resuming sync";
export declare const AUTH_WAIT_LIVENESS_MESSAGE = "hq-sync-runner: still waiting for a valid session";
export type AuthWaitOutcome = "resumed" | "stopped";
/** Secret-free context for the one operational report per auth-wait episode. */
export interface AuthWaitEscalation {
    deviceId: string;
    tenantId: string | null;
    episodeStartedAt: string;
    consecutiveFailures: number;
}
export interface WaitForValidAuthOptions {
    /** Return true when a non-interactive session is usable again. */
    probeAuth: () => Promise<boolean>;
    sleep: (ms: number) => Promise<void>;
    log: (line: string) => void;
    /** Stable machine id, resolvable without an auth session. */
    deviceId: string;
    /** Canonical tenant id when a local, session-free source has one. */
    tenantId?: string | null;
    /** Operational error-tracker/reporting seam. It must not throw into the loop. */
    reportEscalation?: (escalation: AuthWaitEscalation) => void;
    /** Wall/fake clock for the 30-minute liveness line. Defaults to Date.now. */
    now?: () => number;
    isStopped?: () => boolean;
    /** Resolves when the runner is shutting down so a pending sleep can wake. */
    stoppedSignal?: Promise<void>;
    initialRecheckMs?: number;
    steadyRecheckMs?: number;
    livenessIntervalMs?: number;
}
/**
 * Park the watch runner until a session is valid again, or shutdown fires.
 *
 * One start line, then a 60s first recheck, then a steady 5-minute cadence.
 * Failed rechecks are silent except for at most one liveness line per 30
 * minutes. A prolonged continuous failure reports once, then keeps waiting.
 * The only remote call is `probeAuth` itself.
 */
export declare function waitForValidAuth(opts: WaitForValidAuthOptions): Promise<AuthWaitOutcome>;
//# sourceMappingURL=sync-runner-auth-wait.d.ts.map