/**
 * Entity context resolution (VLT-5 US-001).
 *
 * Resolves an entity (company) via vault-service, vends STS-scoped credentials,
 * and returns an EntityContext for S3 operations. Handles auto-refresh when
 * credentials are within 2 minutes of expiry.
 */
import type { EntityContext, VaultServiceConfig } from "./types.js";
/**
 * Closed-set of recognised entity-UID prefixes. Adding a new entity type
 * means appending one entry here AND extending the dispatch in
 * `resolveEntityContext` (cmp_ → /sts/vend, prs_/agt_ → /sts/vend-self).
 *
 * `agt_` (US-013, unblocks US-004): a headless agent box syncs its OWN
 * personal overlay via `hq-sync-runner --personal`, which resolves the
 * agent's own entity (`agt_*`, bucket `hq-vault-agt-<uid>`). Without `agt_`
 * here an agt_ uid is mistaken for a SLUG and routed through the company
 * by-slug lookup; with it, the uid is recognised and self-vended below.
 */
export declare const KNOWN_UID_PREFIXES: readonly ["cmp_", "prs_", "agt_"];
/**
 * Look up an entity by slug or UID via vault-service, then vend STS-scoped
 * credentials for that entity. Returns an EntityContext ready for S3 ops.
 *
 * Caches the result and auto-refreshes when the credentials are within
 * 2 minutes of expiry.
 *
 * HQ-59: when `config.companyVaultUsesPresign` is set, COMPANY (`cmp_*`)
 * contexts skip the `POST /sts/vend` call and come back credential-less with a
 * far-future expiry — the presign transport needs no STS creds, and skipping
 * the vend keeps a compliant sync-runner off the company vend route. Personal
 * (`prs_*`) contexts always vend self.
 */
export declare function resolveEntityContext(companyUidOrSlug: string, config: VaultServiceConfig): Promise<EntityContext>;
/**
 * Check if credentials are expiring within the refresh threshold.
 */
export declare function isExpiringSoon(expiresAt: string): boolean;
/**
 * Force-refresh a cached context. Useful when an S3 operation fails with
 * an expired credentials error.
 */
export declare function refreshEntityContext(companyUidOrSlug: string, config: VaultServiceConfig): Promise<EntityContext>;
/**
 * Clear the entire context cache. Useful for tests.
 */
export declare function clearContextCache(): void;
/** Retryable vault-API statuses (429 and gateway 5xx; not other 4xx). */
export declare function isTransientEntityHttpStatus(status: number): boolean;
/**
 * Test-only sleep for entity-fetch backoff. Production uses `setTimeout`.
 * Pass `undefined` to restore the real sleeper.
 */
export declare function setEntityFetchSleepForTest(sleep: ((ms: number) => Promise<void>) | undefined): void;
/**
 * Parse `Retry-After` as delta-seconds or an HTTP-date. Invalid / missing
 * values return undefined so the caller falls back to exponential backoff.
 */
export declare function parseRetryAfterMs(header: string | null | undefined): number | undefined;
//# sourceMappingURL=context.d.ts.map