import type { ArkmeSessionCredentials } from '../keychain-store.js';
import type { SecretValue } from '../secret-value.js';
export type { ManagedAccessCredentialProvider } from '../managed-access-credential.js';
export interface OpenApiMcpPrincipal {
    userId: number;
    loginDeviceId: number;
}
export interface ManagedOpenApiCredential extends OpenApiMcpPrincipal {
    schemaVersion: 1;
    keyId: string;
    generation: number;
    apiKey: string;
    expiresAtMillis: number;
}
export type OpenApiMcpState = 'inactive' | 'reconciling' | 'ready' | 'degraded';
/** Credential-free lifecycle status for Host API, SDK, UI, and internal diagnostics. */
export interface OpenApiMcpStatus {
    state: OpenApiMcpState;
    retryable: boolean;
    userAction: 'none' | 'login';
    nextReconcileAtMillis?: number;
}
export type ManagedOpenApiControlResult = {
    state: 'ready';
    keyId: string;
    generation: number;
    expiresAtMillis: number;
    reconcileAfterSeconds: number;
} | {
    state: 'issued';
    keyId: string;
    generation: number;
    apiKey: string;
    expiresAtMillis: number;
    reconcileAfterSeconds: number;
};
export interface OpenApiMcpManifest {
    catalogRevision: string;
    runtimeRevision: string;
    endpointPath: string;
    pollAfterSeconds: number;
}
export interface ManagedOpenApiCredentialObservation {
    keyId: string;
    generation: number;
    keyDigest: string;
}
export interface ManagedOpenApiControlPlane {
    ensure(accessToken: SecretValue, observed: ManagedOpenApiCredentialObservation | undefined, signal: AbortSignal): Promise<ManagedOpenApiControlResult>;
    disconnect(apiKey: SecretValue, signal: AbortSignal): Promise<void>;
}
export interface OpenApiMcpManifestSource {
    read(signal: AbortSignal): Promise<OpenApiMcpManifest>;
}
export interface ManagedOpenApiCredentialStore {
    read(): Promise<ManagedOpenApiCredential | undefined>;
    write(credential: ManagedOpenApiCredential): Promise<void>;
    delete(): Promise<void>;
}
export interface OpenApiMcpMount {
    ready(): Promise<void>;
    dispose(): Promise<void>;
}
export interface OpenApiMcpRuntime {
    mount(apiKey: SecretValue, manifest: OpenApiMcpManifest, signal: AbortSignal, onUnavailable: () => void): OpenApiMcpMount;
}
export interface OpenApiMcpReconcileLock {
    run<T>(signal: AbortSignal, operation: () => Promise<T>): Promise<T>;
}
/** Narrow lease used by OpenAPI transports; callers never receive a storable credential string. */
export interface ManagedOpenApiCredentialExecutor {
    executeWithCredential<T>(callerSignal: AbortSignal, execute: (apiKey: SecretValue, signal: AbortSignal) => Promise<T>): Promise<T>;
}
/** Credential-free signal that the managed account lifecycle changed during a call. */
export declare class ManagedOpenApiMcpExecutionSupersededError extends Error {
    constructor();
}
/** Credential-free signal that a managed credential lease crossed an account change. */
export declare class ManagedOpenApiCredentialSupersededError extends Error {
    constructor();
}
/** Credential-free signal that no usable managed credential is currently available. */
export declare class ManagedOpenApiCredentialUnavailableError extends Error {
    constructor();
}
/** Infrastructure-only signal that the leased key was rejected by OpenAPI. */
export declare class ManagedOpenApiCredentialRejectedError extends Error {
    constructor();
}
export declare function openApiMcpPrincipal(session: ArkmeSessionCredentials | undefined): OpenApiMcpPrincipal | undefined;
export declare function sameOpenApiMcpPrincipal(left: ArkmeSessionCredentials | undefined, right: ArkmeSessionCredentials | undefined): boolean;
export declare function credentialBelongsTo(credential: ManagedOpenApiCredential, principal: OpenApiMcpPrincipal): boolean;
//# sourceMappingURL=types.d.ts.map