import { Store } from "./store.js";
import type { Entry } from "./ops.js";
/** Credentials authorize gateway calls only; no account session is issued to an agent. */
export interface Credentials {
    url: string;
    token: string;
    email: string;
    boards?: string[] | null;
}
export interface Session {
    email: string;
    user_id: string;
    boards: string[] | null;
    permission: "read" | "contribute";
    createLimit: number;
    createdCount: number;
}
export declare function credentialsPath(connection?: string): string;
export declare function readCredentials(connection?: string): Promise<Credentials | null>;
/** The connection already holding this account on this server, so reconnecting reuses it. Without an
 * email, the first connection held for this server. */
export declare function findConnection(url: string, email?: string): Promise<string | null>;
/** Whether any Staves account credential is stored on this machine, for any server: the default
 * file, or a credential any named connection holds. Enough to know that connecting this project
 * would reuse an account somebody has already signed in to, without opening it to find out. */
export declare function anyCredentials(): Promise<boolean>;
export declare function writeCredentials(credentials: Credentials, connection?: string): Promise<void>;
export declare function forgetCredentials(connection?: string): Promise<boolean>;
export declare class HostedAuthError extends Error {
}
/** Validate a token and read its grant. Deliberately never receives a Supabase session. */
export declare function exchange(url: string, token: string, fetchImpl?: typeof globalThis.fetch): Promise<Session>;
/** Consume a temporary handoff once. Only the returned durable token is stored locally. */
export declare function pairHandoff(url: string, code: string, fetchImpl?: typeof globalThis.fetch): Promise<string>;
/** A coding agent's Langfuse keys, as the MCP server is launched with them. Never printed or stored locally. */
export interface LangfuseKeys {
    publicKey: string;
    secretKey: string;
    baseUrl?: string;
}
/** What the gateway kept: the project the keys reach, and the connection's boards that now show its runs. */
export interface SharedRuns {
    projectId: string;
    projectName: string | null;
    boards: string[];
}
/** Hand this connection's Langfuse keys to the account once, so staves.io shows its boards' runs.
 * The gateway checks them against Langfuse and stores the secret encrypted; nothing comes back but the project. */
export declare function shareRuns(credentials: Pick<Credentials, "url" | "token">, keys: LangfuseKeys, fetchImpl?: typeof globalThis.fetch): Promise<SharedRuns>;
/** The Langfuse project staves.io shows this connection's runs from, or null when it shows none. */
export declare function runsProject(credentials: Pick<Credentials, "url" | "token">, fetchImpl?: typeof globalThis.fetch): Promise<string | null>;
/** Every operation crosses the gateway with the original scoped token. There is no cached auth
 * session: revocation, invitation changes and grant checks apply to the very next request. */
export declare class GatewayStore extends Store {
    private readonly credentials;
    private readonly requestFetch;
    constructor(credentials: Credentials, userId: string, requestFetch?: typeof globalThis.fetch);
    /** Fresh grant metadata lets agents scope work before consuming creation allowance. */
    access(): Promise<Session>;
    /** The Langfuse project staves.io shows this connection's runs from, or null when it shows none. */
    runsProject(): Promise<string | null>;
    private request;
    private boardResource;
    list(): Promise<string[]>;
    has(board: string): Promise<boolean>;
    touchedAt(board: string): Promise<string | null>;
    protected readLog(board: string): Promise<{
        entries: Entry[];
        revision: number;
    }>;
    protected writeLog(board: string, entries: Entry[], revision: number, mode: "append" | "replace"): Promise<void>;
    branch(base: string, name: string, title: string, baselineName?: string): Promise<import("./model.js").Board>;
    deleteBoard(_board: string): Promise<void>;
    watch(_cb: () => void): () => void;
}
export declare function hostedStore(credentials: Credentials, fetchImpl?: typeof globalThis.fetch): Promise<GatewayStore>;