import type { ToolExecutionResult } from '@deepseek-ai/dsh-tools';
import type { ArkmeSessionCredentials, ArkmeSessionStore } from '../keychain-store.js';
import { SecretValue } from '../secret-value.js';
import type { SessionTransitionObserver } from './session-observer.js';
import { type ManagedAccessCredentialProvider, type ManagedOpenApiControlPlane, type ManagedOpenApiCredential, type ManagedOpenApiCredentialStore, type ManagedOpenApiCredentialExecutor, type OpenApiMcpManifestSource, type OpenApiMcpPrincipal, type OpenApiMcpReconcileLock, type OpenApiMcpRuntime, type OpenApiMcpStatus } from './types.js';
interface OpenApiMcpLogger {
    warn(message: string, ...args: unknown[]): void;
}
export interface OpenApiMcpSessionTransition {
    changed: boolean;
    nextPrincipal?: OpenApiMcpPrincipal;
    previousCredential?: ManagedOpenApiCredential;
}
export interface ManagedOpenApiMcpControllerOptions {
    mountMcp: boolean;
    sessionStore: ArkmeSessionStore;
    accessCredentialProvider: ManagedAccessCredentialProvider;
    controlPlane: ManagedOpenApiControlPlane;
    manifestSource: OpenApiMcpManifestSource;
    credentialStore: ManagedOpenApiCredentialStore;
    runtime: OpenApiMcpRuntime;
    reconcileLock: OpenApiMcpReconcileLock;
    logger: OpenApiMcpLogger;
    now?: () => number;
    random?: () => number;
}
/** Sole owner of managed Key reconciliation and the official MCP Client mount lifecycle. */
export declare class ManagedOpenApiMcpController implements SessionTransitionObserver<OpenApiMcpSessionTransition>, ManagedOpenApiCredentialExecutor {
    private readonly options;
    private readonly now;
    private readonly random;
    private currentStatus;
    private activePrincipal;
    private activeCredential;
    private mounted;
    private operationQueue;
    private credentialTimer;
    private manifestTimer;
    private credentialNextAtMillis;
    private manifestNextAtMillis;
    private activeAbort;
    private mountTransition;
    private mountCleanup;
    private readonly toolExecutionAborts;
    private readonly credentialExecutionAborts;
    private credentialPreparation;
    private toolExecutionEnabled;
    private credentialFailures;
    private manifestFailures;
    private diagnosticPending;
    private epoch;
    private disposed;
    constructor(options: ManagedOpenApiMcpControllerOptions);
    start(): void;
    status(): OpenApiMcpStatus;
    guardToolExecution(toolName: string): string | undefined;
    /** Fences both sides of an official MCP dispatch and diagnoses managed failures in the background. */
    executeManagedTool(toolName: string, callerSignal: AbortSignal, execute: (signal: AbortSignal) => Promise<ToolExecutionResult>): Promise<ToolExecutionResult>;
    /** Leases the current managed API Key to one infrastructure callback and fences account changes. */
    executeWithCredential<T>(callerSignal: AbortSignal, execute: (apiKey: SecretValue, signal: AbortSignal) => Promise<T>): Promise<T>;
    private ensureCredential;
    retry(): Promise<OpenApiMcpStatus>;
    prepare(previous: ArkmeSessionCredentials | undefined, next: ArkmeSessionCredentials | undefined): Promise<OpenApiMcpSessionTransition>;
    committed(ticket: OpenApiMcpSessionTransition): void;
    rolledBack(ticket: OpenApiMcpSessionTransition): void;
    dispose(): Promise<void>;
    private reconcileCredential;
    private refreshManifest;
    private refreshManifestFor;
    private handleCredentialFailure;
    private setStatusAfterCredentialFailure;
    private handleManifestFailure;
    private scheduleDiagnosticReconcile;
    private scheduleCredentialDiagnostic;
    private adoptPrincipal;
    private resolveAccessCredential;
    private replaceMount;
    private mountFresh;
    private mountUnavailable;
    private disposeMount;
    private disableToolExecution;
    private disableCredentialExecution;
    private currentCredential;
    private credentialLeaseMatches;
    private executionMatches;
    private mountMatchesCredential;
    private removeLocalCredential;
    private discardLocalCredential;
    private cleanupTransitionCredential;
    private beginMountCleanup;
    private readLocalCredential;
    private disconnectCredential;
    private scheduleCredential;
    private scheduleManifest;
    private jitter;
    private nextReconcileAtMillis;
    private setReadyStatus;
    private setDegradedStatus;
    private setStatusFromExecutionAvailability;
    private cancelCurrent;
    private assertCurrent;
    private enqueue;
    private setStatus;
    private warn;
}
export {};
//# sourceMappingURL=controller.d.ts.map