import type { TokenStore } from '../token-store.js';
import type { IdentityResolver } from '../identity.js';
import type { AuditSink } from '../audit.js';
import type { RateLimiter } from '../rate-limit.js';
import { mintToken } from '../token.js';
export type MintDeps = {
    tokenStore: TokenStore;
    identityResolver: IdentityResolver;
    auditSink: AuditSink;
    /**
     * Rate limiter for the mint endpoint. Mint is checked BEFORE any
     * record is created, keyed by resolved identity (or client IP for
     * anonymous callers), so a caller can't spam token records into
     * existence. Optional for back-compat; when omitted, mint is
     * unthrottled (the core always wires one).
     */
    rateLimiter?: RateLimiter;
    /**
     * Bucket key for an anonymous caller (one the identity resolver
     * returns nothing for). Defaults to {@link clientIpOf} with NO proxy
     * trust, which puts every such caller in one shared bucket — see that
     * module for why a forwarding header is not a default identity. Hosts
     * behind a proxy, or with the socket address in hand, pass a resolver
     * built by `createClientIpResolver`; `createLluiAgentCore` builds one
     * from its `trustProxy`/`clientAddress` options and wires it here.
     */
    clientIp?: (req: Request) => string;
    lapBasePath: string;
    /**
     * Permit minting a remote-control token for an UNAUTHENTICATED caller
     * (one the `identityResolver` resolves to `null`/`undefined`).
     *
     * SECURITY: defaults to `false` — fail closed. Without an identity and
     * without this explicit opt-in, `POST /agent/mint` returns 401 and no
     * token is created, so a deployment that forgets to configure an
     * identity resolver can't hand out remote-control tokens to anyone who
     * can reach the endpoint. Set `true` only for genuinely anonymous apps
     * that intend to let any visitor pair an agent.
     */
    allowAnonymous?: boolean;
    /** Wall-clock in milliseconds; injectable for tests. */
    now?: () => number;
    /** UUID generator; injectable for tests. */
    uuid?: () => string;
    /** Hard-expiry window, default 24 h. */
    hardExpiryMs?: number;
    /**
     * Override the token mint primitive (for tests that need a known
     * token value). Production uses the default opaque mint.
     */
    mint?: typeof mintToken;
};
/**
 * POST /agent/mint — creates a pairing record and returns the mint
 * response. The caller is responsible for routing
 * `/agent/mint` requests to this handler; `router.ts` composes that.
 */
export declare function handleMint(req: Request, deps: MintDeps): Promise<Response>;
//# sourceMappingURL=mint.d.ts.map