import type { IssuedGovernanceCapabilityGrant, IssueGovernanceCapabilityGrantOptions } from './capability-grant.js';
import { type GovernanceDaemonAttachmentBrokerRecord, type GovernanceDaemonMetadata } from './daemon-metadata.js';
/**
 * `issuedBy` stamped on the broker's own grant. The idle check keys on it to
 * tell the daemon's self-held credential apart from grants clients hold.
 */
export declare const GOVERNANCE_DAEMON_OWNER_ISSUER = "governance-daemon-owner";
type GovernanceAttachmentBrokerLifecycleEventType = 'published' | 'renewal_failed' | 'degraded' | 'revocation_failed' | 'recovered' | 'stopped';
export interface GovernanceAttachmentBrokerLifecycleEvent {
    readonly schemaVersion: 1;
    readonly sequence: number;
    readonly type: GovernanceAttachmentBrokerLifecycleEventType;
    readonly projectId: string;
    readonly instanceId: string;
    readonly occurredAt: string;
    readonly state: GovernanceAttachmentBrokerControllerSnapshot['state'];
    readonly health: GovernanceAttachmentBrokerControllerSnapshot['health'];
    readonly grantId: string | null;
    readonly expiresAt: string | null;
    readonly consecutiveFailures: number;
    readonly pendingRevocations: number;
    readonly message?: string | undefined;
}
export interface GovernanceAttachmentBrokerScheduler {
    schedule(callback: () => void, delayMs: number): unknown;
    cancel(handle: unknown): void;
}
export interface GovernanceAttachmentBrokerControllerSnapshot {
    readonly state: 'idle' | 'active' | 'retry_wait' | 'stopped';
    readonly health: 'initializing' | 'healthy' | 'degraded' | 'stopped';
    readonly grantId: string | null;
    readonly expiresAt: string | null;
    readonly consecutiveFailures: number;
    readonly pendingRevocations: number;
    readonly auditHealthy: boolean;
    readonly nextActionAt?: string | undefined;
    readonly lastFailure?: string | undefined;
    readonly lastAuditFailure?: string | undefined;
}
interface GovernanceAttachmentBrokerGrantPort {
    issueGrant(options: IssueGovernanceCapabilityGrantOptions): IssuedGovernanceCapabilityGrant;
    revokeGrant(grantId: string, reason?: string): boolean;
}
interface GovernanceAttachmentBrokerControllerOptions {
    readonly projectRoot: string;
    readonly metadata: GovernanceDaemonMetadata;
    readonly grants: GovernanceAttachmentBrokerGrantPort;
    readonly ttlMs?: number | undefined;
    readonly renewBeforeMs?: number | undefined;
    readonly retryMs?: number | undefined;
    readonly degradedFailureThreshold?: number | undefined;
    readonly now?: (() => number) | undefined;
    readonly scheduler?: GovernanceAttachmentBrokerScheduler | undefined;
    readonly publish?: ((broker: GovernanceDaemonAttachmentBrokerRecord) => Promise<void>) | undefined;
    readonly remove?: (() => Promise<boolean>) | undefined;
    readonly onEvent?: ((event: GovernanceAttachmentBrokerLifecycleEvent) => void) | undefined;
}
export declare class GovernanceAttachmentBrokerController {
    #private;
    constructor(options: GovernanceAttachmentBrokerControllerOptions);
    start(): Promise<GovernanceDaemonAttachmentBrokerRecord>;
    rotateNow(): Promise<GovernanceDaemonAttachmentBrokerRecord>;
    stop(): Promise<GovernanceAttachmentBrokerControllerSnapshot>;
    snapshot(): GovernanceAttachmentBrokerControllerSnapshot;
    private rotateOnce;
    private publish;
    private remove;
    private revokePending;
    private health;
    private emit;
    private schedule;
    private cancelTimer;
}
export {};
//# sourceMappingURL=attachment-broker-controller.d.ts.map