/**
 * Ably token provisioning for the chat widget.
 *
 * - `requestToken()` performs the initial token request before the Ably
 *   client is created.
 * - `createAuthCallback()` builds the `authCallback` Ably calls when it
 *   needs to refresh or scope a token (e.g. attaching to a per-channel
 *   subscription). The callback guards against clientId mismatches (40102)
 *   that would land the connection in the terminal `failed` state.
 *
 * No DOM, no Ably types — just `fetch` + the wire payload + a thin
 * `IdentityChangeHook` callback for the rare clientId drift case.
 *
 * See: docs/modules/chat/widget-architecture.md (Race-free identity changes)
 */
import type { TokenRequest } from "ably";
import { type ApiRequestInstance } from "../chat-api";
export interface InitialTokenResponse {
    tokenRequest: TokenRequest;
    clientId: string;
    projectId: number;
}
/** Wire payload returned by the widget token endpoint. */
interface RawTokenResponse {
    success: boolean;
    tokenRequest: TokenRequest;
    clientId?: string;
    project_id?: number;
}
/**
 * Request an Ably token from the widget endpoint.
 *
 * Returns `null` when the request fails — the caller should bail out and
 * leave the store in `connectionState: "failed"`.
 */
export declare function requestToken(instance: ApiRequestInstance, distinctId: string, channelId?: string): Promise<RawTokenResponse | null>;
/**
 * Request the initial token used to bootstrap the Ably client. Asserts that
 * `clientId` and `project_id` are present, since both are required to
 * authorize the connection.
 */
export declare function requestInitialToken(instance: ApiRequestInstance, distinctId: string): Promise<InitialTokenResponse | null>;
/**
 * Provide the live Ably client's clientId. Returning `null` short-circuits
 * the mismatch guard (used in tests / before the client exists).
 */
export type LiveClientIdAccessor = () => string | null;
/** Notify the controller that a clientId drift was detected. */
export type IdentityChangeHook = () => void;
/**
 * Build an Ably `authCallback`. Each refresh:
 *
 * 1. Calls the widget token endpoint with the *current* channel scope
 *    (derived from the store's `realtimeChannelId` / `pendingRealtimeChannelId`).
 * 2. Verifies the token's `clientId` matches the live connection's
 *    `clientId`. If they differ, refuses the token and fires the identity
 *    change hook — refusing here prevents Ably from transitioning to the
 *    terminal `failed` state.
 */
export declare function createAuthCallback(args: {
    instance: ApiRequestInstance;
    getDistinctId: () => string;
    getChannelScope: () => string | null;
    getLiveClientId: LiveClientIdAccessor;
    onIdentityChange: IdentityChangeHook;
    shouldAbort?: () => boolean;
}): (_: unknown, cb: (err: string | null, token: TokenRequest | null) => void) => Promise<void>;
export {};