/**
 * HTTP client for the omp auth-broker server.
 *
 * Used by {@link RemoteAuthCredentialStore} (snapshot pulls) and by
 * `omp auth-broker status` (liveness checks). All endpoints except
 * `/v1/healthz` require a bearer token.
 */
import type { AuthCredential, DisabledCredentialSummary } from "../auth-storage.js";
import type { ClientUsageReportRequest, ClientUsageReportResponse, ClientUsageSummaryResponse, CredentialBlockRequest, CredentialBlockResponse, CredentialBlocksDeleteResponse, CredentialDisableResponse, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageHistoryResponse, UsageResponse, UsageStaleResponse } from "./types.js";
export interface AuthBrokerClientOptions {
    /** Base URL (e.g. `https://broker.tailnet:8765`). Trailing slashes are trimmed. */
    url: string;
    /** Bearer token used for everything except `healthz`. */
    token: string;
    /** Per-request timeout in milliseconds. Default 10s. */
    timeoutMs?: number;
    /** Retry connection errors this many times. Default 1. */
    maxRetries?: number;
    /** Override fetch (used in tests). Default global `fetch`. */
    fetchImpl?: typeof fetch;
}
export declare class AuthBrokerError extends Error {
    readonly status: number | undefined;
    readonly body: string | undefined;
    constructor(message: string, opts?: {
        status?: number;
        body?: string;
        cause?: unknown;
    });
}
/**
 * Thrown when a broker responds 404 to `GET /v1/snapshot/stream` — old
 * brokers that predate the SSE endpoint. Callers (`RemoteAuthCredentialStore`)
 * detect this sentinel to fall back to long-polling permanently.
 */
export declare class AuthBrokerStreamUnsupportedError extends AuthBrokerError {
    constructor(message?: string);
}
export interface FetchSnapshotOptions {
    ifGenerationGt?: number;
    waitMs?: number;
    signal?: AbortSignal;
}
export type FetchSnapshotResult = {
    status: 200;
    snapshot: SnapshotResponse;
    generation: number;
} | {
    status: 304;
    generation: number;
};
export declare class AuthBrokerClient {
    #private;
    constructor(opts: AuthBrokerClientOptions);
    healthz(signal?: AbortSignal): Promise<HealthzResponse>;
    fetchSnapshot(opts?: FetchSnapshotOptions): Promise<FetchSnapshotResult>;
    /**
     * Subscribe to the broker's SSE snapshot stream. The first frame is always
     * a full `snapshot`; subsequent frames are `entry` upserts / refreshes or
     * `removed` deletes. Caller controls lifecycle via `opts.signal`.
     *
     * Throws {@link AuthBrokerStreamUnsupportedError} when the broker responds
     * 404 — older brokers predate this endpoint and the caller should fall back
     * to long-polling for the remainder of its lifetime.
     */
    openSnapshotStream(opts?: {
        signal?: AbortSignal;
    }): AsyncGenerator<SnapshotStreamEvent>;
    /**
     * Fetch aggregate broker usage with a timeout sized for serialized
     * same-provider account probes.
     */
    fetchUsage(options?: {
        signal?: AbortSignal;
        maxAccountsPerProvider?: number;
    }): Promise<UsageResponse>;
    /** Recorded usage-limit snapshots from the broker host, oldest first. */
    fetchUsageHistory(query?: {
        sinceMs?: number;
        provider?: string;
    }, signal?: AbortSignal): Promise<UsageHistoryResponse>;
    /** Report this client's batched observed request usage for per-install burn tracking. */
    reportClientUsage(report: ClientUsageReportRequest, signal?: AbortSignal): Promise<ClientUsageReportResponse>;
    /** Per-client token burn aggregates recorded by the broker host. */
    fetchClientUsageSummary(query?: {
        sinceMs?: number;
    }, signal?: AbortSignal): Promise<ClientUsageSummaryResponse>;
    notifyUsageStale(signal?: AbortSignal): Promise<UsageStaleResponse>;
    refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
    disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse>;
    /**
     * Disabled-credential tombstones (identity + cause, no token material).
     * Returns an empty list against brokers predating `GET
     * /v1/credentials/disabled` (404).
     */
    listDisabledCredentials(provider?: string, signal?: AbortSignal): Promise<DisabledCredentialSummary[]>;
    uploadCredential(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialUploadResponse>;
    upsertCredentialBlock(id: number, block: CredentialBlockRequest, signal?: AbortSignal): Promise<CredentialBlockResponse>;
    deleteCredentialBlocks(id: number, signal?: AbortSignal): Promise<CredentialBlocksDeleteResponse>;
}