import { DEMO_RPC_ALLOWLIST, DEMO_RPC_WRITE_BLOCKLIST } from '@zhin.js/console-protocol';
export { DEMO_RPC_ALLOWLIST, DEMO_RPC_WRITE_BLOCKLIST };
/** Demo Host token scope: RPC/HTTP/WS allowlists (ADR 0016). */
export type AuthScope = "full" | "demo";
export type ScopedTokenConfig = {
    token: string;
    scope: AuthScope;
};
export type TokenRegistryConfig = {
    primaryToken: string;
    scopedTokens?: ScopedTokenConfig[];
};
export declare class TokenRegistry {
    private readonly entries;
    constructor(config: TokenRegistryConfig);
    resolve(token: string): AuthScope | null;
    hasAnyToken(): boolean;
    /** Primary token prefix for startup logs (first full-scope token, first 6 chars). */
    primaryTokenPrefixForLog(): string;
}
export declare function isDemoRpcAllowed(rpcType: string): boolean;
export declare function assertDemoRpcAllowed(rpcType: string): string | null;
/**
 * Whether an authenticated HTTP request may proceed under demo scope.
 * Assumes auth already passed; `/pub` never reaches here with auth required.
 */
export declare function isDemoHttpAllowed(method: string, pathname: string, apiBase: string): boolean;
/** WebSocket upgrade paths allowed for demo scope. */
export declare function isDemoWebSocketPath(pathname: string | null | undefined): boolean;
//# sourceMappingURL=demo-scope.d.ts.map