import type { AuthTokenSource, FetchLike } from "./push-transport.js";
import { type RealtimeCapabilityVector, type RealtimeInventoryGrant, type RealtimeRolloutClient } from "./realtime-rollout.js";
export declare const MAX_REALTIME_LEASE_MS = 60000;
export declare const MAX_REALTIME_LEASE_CLOCK_SKEW_MS = 5000;
export interface RealtimeLease {
    lease: string;
    issuedAt: string;
    expiresAt: string;
    authorizationEpoch: string;
}
/**
 * The lease is server-signed and opaque for authorization purposes, but its
 * payload includes the membership revision that a V2 mutation must echo in
 * its prepare body.  This is deliberately only a local hint: the server still
 * validates the signature and every bound field before accepting I/O.
 */
export declare function membershipRevisionFromLease(lease: RealtimeLease): string;
export interface RealtimeLeaseRequest {
    bearer: string;
    deviceId: string;
    capabilityVector: RealtimeCapabilityVector;
    scopeHandle: string;
    scopeRevision: string;
}
export interface RealtimeLeaseClientOptions {
    apiUrl: string;
    fetchImpl?: FetchLike;
    now?: () => number;
    authorizationTimeoutMs?: number;
}
/** Issues a non-cacheable, <=60 second lease for one exact inventory grant. */
export declare class RealtimeLeaseClient {
    private readonly apiUrl;
    private readonly fetchImpl;
    private readonly now;
    private readonly authorizationTimeoutMs;
    constructor(options: RealtimeLeaseClientOptions);
    assertUsable(lease: RealtimeLease): void;
    issue(request: RealtimeLeaseRequest): Promise<RealtimeLease>;
}
export interface RealtimeScopeAuthorization {
    grant: RealtimeInventoryGrant & {
        state: "v2-ready";
        scopeHandle: string;
    };
    lease: RealtimeLease;
}
export interface RealtimePassAuthorization {
    /** One resolved bearer is reused by every inventory and lease request in this pass. */
    bearer: string;
    scopes: readonly RealtimeScopeAuthorization[];
}
export interface RealtimePassRequest {
    deviceId: string;
    capabilityVector: RealtimeCapabilityVector;
    configurationFingerprint: string;
    scopeFingerprint: string;
    scopeUids: readonly string[];
}
/** A server inventory result that deliberately does not enroll this client. */
export declare class RealtimeEnrollmentUnavailableError extends Error {
    constructor();
}
/**
 * The only pre-I/O admission seam for later V2 work. It intentionally has no
 * V1 fallback: malformed, stale, revoked, or non-ready inventory never gives
 * an operation a lease. It resolves its bearer once, then reissues leases on
 * every guarded pass so cached positives cannot cross server config/scope
 * changes.
 */
export declare class RealtimePassAuthorizer {
    private readonly authToken;
    private readonly inventoryClient;
    private readonly leaseClient;
    constructor(authToken: AuthTokenSource, inventoryClient: RealtimeRolloutClient, leaseClient: RealtimeLeaseClient);
    authorize(request: RealtimePassRequest): Promise<RealtimePassAuthorization>;
    /**
     * Authorize a caller that already resolved the bearer for a related local
     * lookup.  This keeps scope discovery and lease issuance on one principal;
     * it does not cache or otherwise extend the bearer lifetime.
     */
    authorizeWithBearer(bearer: string, request: RealtimePassRequest): Promise<RealtimePassAuthorization>;
    runBeforeIo<T>(request: RealtimePassRequest, operation: (authorization: RealtimePassAuthorization) => Promise<T>): Promise<T>;
}
//# sourceMappingURL=lease-client.d.ts.map