/** Demo Host token scope (ADR 0016 subset for Plugin Runtime Host). */
export type AuthScope = 'full' | 'demo';
export type ScopedTokenConfig = {
    readonly token: string;
    readonly scope: AuthScope;
    /** Root-configured subject binding; never accepted from an HTTP payload. */
    readonly principalId?: string;
};
export interface AuthenticatedTokenPrincipal {
    readonly principalId: string;
    readonly scope: AuthScope;
}
export type TokenRegistryConfig = {
    readonly primaryToken?: string;
    readonly scopedTokens?: readonly ScopedTokenConfig[];
};
export type DynamicTokenConfig = ScopedTokenConfig & {
    /** Unix epoch milliseconds; omitted credentials remain valid until explicitly revoked. */
    readonly expiresAt?: number;
};
export declare class TokenRegistry {
    #private;
    constructor(config?: TokenRegistryConfig);
    resolve(token: string): AuthScope | null;
    resolvePrincipal(token: string): AuthenticatedTokenPrincipal | null;
    hasAnyToken(): boolean;
    /** Registers a runtime-issued credential and returns an idempotent revoker. */
    register(config: DynamicTokenConfig): () => void;
    revoke(token: string): boolean;
    primaryTokenPrefixForLog(): string;
}
/** WebSocket upgrade paths allowed for demo scope. */
export declare function isDemoWebSocketPath(pathname: string): boolean;
export declare function extractBearerToken(authorization: string | undefined, queryToken: string | null): string;