export declare const OWNER_SESSION_HEADER = "X-Otto-Owner-Session";
export type OwnerAuthState = {
    status: 'owner';
} | {
    status: 'share';
} | {
    status: 'unauthenticated';
};
export type OwnerAuthorizationResult = {
    ok: true;
    expiresAt: number | null;
} | {
    ok: false;
    reason: 'unavailable';
    message: string;
} | {
    ok: false;
    reason: 'error';
    code: string;
    status?: number;
    message: string;
};
/** Subscribes to owner-session changes; returns an unsubscribe function. */
export declare function onOwnerSessionChange(listener: () => void): () => void;
/**
 * Returns the active owner session bearer (memory-only exchange result, or a
 * desktop-supplied session), or undefined when none is live.
 */
export declare function getOwnerSessionToken(): string | undefined;
/** Auth headers for the active owner session, if any. */
export declare function getOwnerSessionHeaders(): Record<string, string>;
/** Clears the memory-only owner session for this tab. */
export declare function clearOwnerSession(): void;
/**
 * Resolves the current owner-auth state.
 * - `share`: booted from a `?share=` link (owner controls hidden).
 * - `owner`: a daemon server token or a live owner session is present.
 * - `unauthenticated`: neither credential is available.
 */
export declare function getOwnerAuthState(): OwnerAuthState;
/** True when the current session has full owner access. */
export declare function isOwnerAuthenticated(): boolean;
/** Requests a one-time owner authorization challenge from the daemon. */
export declare function requestOwnerChallenge(): Promise<{
    challenge: string;
    deviceId: string;
    expiresIn: number;
}>;
/**
 * Drives the full owner authorization exchange from a signed assertion:
 * exchanges the assertion for a Secure HttpOnly cookie and records a
 * memory-only bearer for immediate follow-up requests.
 *
 * The assertion must have been minted for a challenge issued by this daemon.
 * Callers that also need the challenge (to request the assertion) should use
 * `requestOwnerChallenge()` first and thread it through their assertion source.
 */
export declare function authorizeOwnerWithAssertion(assertion: string): Promise<OwnerAuthorizationResult>;
/**
 * Owner authorization entry point for the gate. Returns `owner` when a session
 * already exists (local token, live exchange result, or desktop-supplied
 * bearer), otherwise reports `unavailable` because the browser cannot mint a
 * setu assertion on its own. A secure assertion source (desktop shell or a
 * future redirect/connect flow) must call `authorizeOwnerWithAssertion`.
 */
export declare function beginOwnerAuthorization(): OwnerAuthorizationResult;
export declare class OwnerAuthError extends Error {
    readonly code: string;
    readonly status?: number;
    constructor(code: string, message: string, status?: number);
}
//# sourceMappingURL=owner-auth.d.ts.map