import type { GovernanceServiceCredential } from './capability-grant.js';
import type { GovernanceServiceResponse } from './project-service.js';
type GovernanceCredentialLeaseState = 'idle' | 'scheduled' | 'rotating' | 'retry_wait' | 'stopped' | 'expired';
type GovernanceCredentialLeaseStopReason = 'stopped_by_owner' | 'retry_exhausted' | 'credential_expired';
export interface GovernanceCredentialLeaseSnapshot {
    readonly state: GovernanceCredentialLeaseState;
    readonly projectId: string;
    readonly clientId: string;
    readonly grantId: string;
    readonly expiresAt: string;
    readonly rotationAttempt: number;
    readonly nextActionAt?: string | undefined;
    readonly stopReason?: GovernanceCredentialLeaseStopReason | undefined;
    readonly lastFailure?: string | undefined;
}
export interface GovernanceCredentialLeaseScheduler {
    schedule(callback: () => void, delayMs: number): unknown;
    cancel(handle: unknown): void;
}
interface GovernanceCredentialLeaseClient {
    request(input: unknown): Promise<GovernanceServiceResponse>;
}
interface GovernanceCredentialLeaseControllerOptions {
    readonly projectRoot: string;
    readonly projectId: string;
    readonly grantId: string;
    readonly expiresAt: string;
    readonly credential: GovernanceServiceCredential;
    readonly rotationTtlMs?: number | undefined;
    readonly renewBeforeMs?: number | undefined;
    readonly retryDelayMs?: number | undefined;
    readonly maxAttempts?: number | undefined;
    readonly requestTimeoutMs?: number | undefined;
    readonly now?: (() => number) | undefined;
    readonly scheduler?: GovernanceCredentialLeaseScheduler | undefined;
    readonly requestIdFactory?: (() => string) | undefined;
    readonly clientFactory?: ((credential: GovernanceServiceCredential) => GovernanceCredentialLeaseClient) | undefined;
}
/**
 * Opt-in process-local holder for one self-rotating capability_admin credential.
 * It never persists or exposes the current bearer token.
 */
export declare class GovernanceCredentialLeaseController implements GovernanceCredentialLeaseClient {
    private readonly projectRoot;
    private readonly projectId;
    private readonly clientId;
    private readonly rotationTtlMs;
    private readonly renewBeforeMs;
    private readonly retryDelayMs;
    private readonly maxAttempts;
    private readonly now;
    private readonly scheduler;
    private readonly requestIdFactory;
    private readonly clientFactory;
    private client;
    private credential;
    private grantId;
    private expiresAtMs;
    private state;
    private rotationAttempt;
    private cycleRequestId;
    private timer;
    private nextActionAtMs;
    private stopReason;
    private lastFailure;
    private stopped;
    private inFlight;
    constructor(options: GovernanceCredentialLeaseControllerOptions);
    start(): GovernanceCredentialLeaseSnapshot;
    stop(): GovernanceCredentialLeaseSnapshot;
    request(input: unknown): Promise<GovernanceServiceResponse>;
    rotateNow(): Promise<GovernanceCredentialLeaseSnapshot>;
    snapshot(): GovernanceCredentialLeaseSnapshot;
    private rotateOnce;
    private handleFailure;
    private scheduleRenewal;
    private schedule;
    private clearTimer;
    private expire;
}
export {};
//# sourceMappingURL=credential-lease-controller.d.ts.map