/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * The persisted app session: what a reload needs to restore the authenticated
 * state with ZERO wallet popups, adapted to the RP model where the seed itself
 * is persisted -- the wallet remains the recovery source of truth, this is only
 * the hot cache.
 *
 * Record: `{ seed, controllerDid, serverUrl, spaceId, grants, expires }`.
 * `expires` is the earliest `expires` across the granted zcaps; a record past
 * it is cleared on load and the caller falls through to the returning-login
 * flow (same seed comes back from the wallet, same DID, same vault keys).
 *
 * Persistence rides on a `SeedStore` (see `seedStore.ts`) the caller supplies.
 */
import type { IZcap } from '@interop/data-integrity-core';
import type { SeedStore } from './seedStore.js';
export interface AppSessionRecord {
    controllerDid: string;
    serverUrl: string;
    spaceId: string;
    grants: IZcap[];
    /**
     * ISO timestamp: the earliest expiry across the granted zcaps.
     */
    expires: string;
}
/**
 * A restored session: the record plus the separately persisted seed.
 */
export interface RestoredAppSession extends AppSessionRecord {
    seed: Uint8Array;
}
/**
 * A nominal far-future expiry (ms) standing in for "no expiry": used both for a
 * login that returned no grants (so there is no earliest-expiry to report) and
 * for grants minted without one (dev/test). Well past any near-expiry warning,
 * so the expiry watch never fires against it.
 */
export declare const NO_EXPIRY_MS: number;
/**
 * Whether an ISO `expires` timestamp is in the past (or malformed).
 */
export declare function isExpired(expires: string, now?: Date): boolean;
/**
 * Whether an ISO `expires` timestamp is within `thresholdMs` of now (or already
 * past, or malformed) -- the signal to surface the reconnect banner proactively,
 * before a live request fails with 401/403.
 */
export declare function isNearExpiry(expires: string, thresholdMs: number, now?: Date): boolean;
/**
 * The earliest `expires` across a grant set. Grants without a parseable
 * `expires` are ignored; returns `null` when none carries one (callers treat
 * that as not restorable -- wallet grants always carry an expiry).
 */
export declare function earliestExpiry(grants: IZcap[]): string | null;
/**
 * Persists the session (seed + record) for hot restore.
 *
 * @param options {object}
 * @param options.session {RestoredAppSession}
 * @param options.store {SeedStore}
 * @returns {Promise<void>}
 */
export declare function persistAppSession({ session, store }: {
    session: RestoredAppSession;
    store: SeedStore;
}): Promise<void>;
/**
 * Reads the persisted seed and session record WITHOUT clearing anything and
 * WITHOUT applying the expiry rule -- the reconnect path's read, where the
 * record being past its expiry is the normal case and the seed must survive it
 * (only the grants need renewing). Either half comes back `null` when it is
 * missing or malformed.
 *
 * Use {@link restoreAppSession} for a hot restore instead: it enforces the
 * expiry and wipes a stale record.
 *
 * @param options {object}
 * @param options.store {SeedStore}
 * @returns {Promise<{ seed: Uint8Array | null, record: AppSessionRecord | null }>}
 */
export declare function peekAppSession({ store }: {
    store: SeedStore;
}): Promise<{
    seed: Uint8Array | null;
    record: AppSessionRecord | null;
}>;
/**
 * Restores the persisted session, or returns `null` (clearing any stale state)
 * when it is missing, malformed, or expired.
 *
 * @param options {object}
 * @param options.store {SeedStore}
 * @returns {Promise<RestoredAppSession | null>}
 */
export declare function restoreAppSession({ store }: {
    store: SeedStore;
}): Promise<RestoredAppSession | null>;
/**
 * Wipes the persisted session (seed + record).
 *
 * @param options {object}
 * @param options.store {SeedStore}
 * @returns {Promise<void>}
 */
export declare function clearAppSession({ store }: {
    store: SeedStore;
}): Promise<void>;
//# sourceMappingURL=appSession.d.ts.map