import { type GovernanceServiceCapability, type GovernanceServiceClientContext } from './service-protocol.js';
export declare const DEFAULT_GOVERNANCE_GRANT_MAX_TTL_MS: number;
type GovernanceCapabilityGrantStatus = 'active' | 'expired' | 'revoked';
export interface GovernanceCapabilityGrant {
    readonly grantId: string;
    readonly projectId: string;
    readonly clientId: string;
    readonly issuedBy: string;
    readonly capabilities: readonly GovernanceServiceCapability[];
    readonly issuedAt: string;
    readonly expiresAt: string;
    readonly status: GovernanceCapabilityGrantStatus;
    readonly revokedAt?: string | undefined;
    readonly revokedBy?: string | undefined;
    readonly revocationReason?: string | undefined;
}
export interface IssuedGovernanceCapabilityGrant {
    readonly token: string;
    readonly grant: GovernanceCapabilityGrant;
}
export interface IssueGovernanceCapabilityGrantOptions {
    readonly clientId: string;
    readonly issuedBy?: string | undefined;
    readonly capabilities: readonly GovernanceServiceCapability[];
    readonly ttlMs: number;
}
interface RotateGovernanceCapabilityGrantOptions {
    readonly rotatedBy?: string | undefined;
    readonly ttlMs: number;
    readonly reason?: string | undefined;
}
export interface GovernanceServiceCredential {
    readonly token: string;
    readonly projectId: string;
    readonly clientId: string;
}
type GovernanceCapabilityAuthenticationFailureCode = 'invalid_token' | 'project_mismatch' | 'client_mismatch' | 'grant_expired' | 'grant_revoked';
type GovernanceCapabilityAuthenticationResult = {
    readonly authenticated: true;
    readonly grant: GovernanceCapabilityGrant;
    readonly client: GovernanceServiceClientContext;
} | {
    readonly authenticated: false;
    readonly code: GovernanceCapabilityAuthenticationFailureCode;
    readonly message: string;
};
export type GovernanceGrantAuditEvent = {
    readonly sequence: number;
    readonly type: 'grant_issued';
    readonly grantId: string;
    readonly projectId: string;
    readonly clientId: string;
    readonly issuedBy: string;
    readonly capabilities: readonly GovernanceServiceCapability[];
    readonly occurredAt: string;
    readonly expiresAt: string;
} | {
    readonly sequence: number;
    readonly type: 'grant_revoked';
    readonly grantId: string;
    readonly projectId: string;
    readonly clientId: string;
    readonly revokedBy: string;
    readonly occurredAt: string;
    readonly reason: string;
} | {
    readonly sequence: number;
    readonly type: 'grant_expired';
    readonly grantId: string;
    readonly projectId: string;
    readonly clientId: string;
    readonly occurredAt: string;
    readonly reason: string;
} | {
    readonly sequence: number;
    readonly type: 'grant_rotated';
    readonly grantId: string;
    readonly previousGrantId: string;
    readonly projectId: string;
    readonly clientId: string;
    readonly rotatedBy: string;
    readonly capabilities: readonly GovernanceServiceCapability[];
    readonly occurredAt: string;
    readonly expiresAt: string;
    readonly reason: string;
};
export interface GovernanceCapabilityGrantRegistryOptions {
    readonly now?: (() => number) | undefined;
    readonly maxTtlMs?: number | undefined;
    readonly maxGrants?: number | undefined;
    readonly tokenMaterial?: (() => {
        readonly grantId: string;
        readonly secret: string;
    }) | undefined;
    readonly auditSink?: ((event: GovernanceGrantAuditEvent) => void) | undefined;
}
export declare class GovernanceCapabilityGrantRegistry {
    readonly projectId: string;
    private readonly records;
    private readonly now;
    private readonly maxTtlMs;
    private readonly maxGrants;
    private readonly tokenMaterial;
    private readonly auditSink;
    private auditSequence;
    constructor(projectId: string, options?: GovernanceCapabilityGrantRegistryOptions);
    issue(options: IssueGovernanceCapabilityGrantOptions): IssuedGovernanceCapabilityGrant;
    rotate(grantId: string, options: RotateGovernanceCapabilityGrantOptions): IssuedGovernanceCapabilityGrant;
    authenticate(credential: GovernanceServiceCredential): GovernanceCapabilityAuthenticationResult;
    revoke(grantId: string, reason?: string, revokedBy?: string): boolean;
    sweepExpired(reason?: string): number;
    getGrant(grantId: string): GovernanceCapabilityGrant | null;
    remainingTtlMs(grantId: string): number | null;
    /**
     * Ordering is deliberately byte-wise rather than locale-aware. Both keys are
     * ASCII by construction — `issuedAt` is an ISO-8601 timestamp and `grantId`
     * matches `^[A-Za-z0-9_-]{1,128}$` — so the two orders are identical, but
     * `localeCompare` would make the order depend on the host's default locale.
     * This list backs the `list_capability_grants` cursor, and a cursor is only
     * sound while the order it walks is stable across the requests that walk it.
     */
    listGrants(): readonly GovernanceCapabilityGrant[];
    private parseToken;
    private describe;
    private reject;
    private appendAudit;
    private pruneInactive;
    /**
     * True when at least one grant is still usable (neither expired nor revoked).
     *
     * The daemon's idle shutdown asks this before stopping: a live grant means a
     * client still holds credentials it expects to rotate, and the rotation is
     * what keeps the daemon's activity clock warm. Stopping underneath one would
     * break an admin session that is merely between requests.
     *
     * Prunes first, so the answer reflects the clock rather than stale records.
     * That emits `grant_expired` audit events for anything it reaps, which is
     * why the caller must not poll this: the idle timer asks at most once per
     * idle window.
     *
     * `excludeIssuedBy` skips grants the daemon issued to itself (its attachment
     * broker): that grant is renewed for the daemon's whole life, so counting it
     * would mean the daemon can never look idle.
     */
    hasActiveGrants(excludeIssuedBy?: string): boolean;
}
export {};
//# sourceMappingURL=capability-grant.d.ts.map