import { AgentSubjectDisplayCache } from './subject-display.js';
import { type AgentCredentials, type CommandRunner, type CredentialStore } from './credential-store.js';
export type AgentConnectionDescriptor = {
    baseUrl: string;
    clientAppId: string;
    workspace: string;
    allowInsecureHttp?: boolean;
};
export type AgentConnectionProfile = Omit<AgentConnectionDescriptor, 'allowInsecureHttp'> & {
    connectionKey: string;
    connectionInstanceId?: string;
    alias?: string;
    allowInsecureHttp: boolean;
    createdAt: string;
    updatedAt: string;
};
export type LegacyCredentialMigrationResult = 'migrated' | 'no_legacy_credentials' | 'legacy_connection_mismatch' | 'target_already_exists';
export declare function agentConnectionKey(value: AgentConnectionDescriptor): string;
/** Derives the isolated credential key for one named instance of a public connection binding. */
export declare function agentConnectionInstanceKey(value: AgentConnectionDescriptor, connectionInstanceId: string): string;
export declare function defaultConnectionRegistryPath(storageNamespace?: string, platform?: NodeJS.Platform, environment?: NodeJS.ProcessEnv): string;
export declare function defaultConnectionCredentialPath(connectionKey: string, storageNamespace?: string, platform?: NodeJS.Platform, environment?: NodeJS.ProcessEnv): string;
export declare function defaultConnectionKeychainAccount(connectionKey: string, storageNamespace?: string): string;
/** Public connection metadata only. Tokens are always stored by a separate CredentialStore. */
export declare class AgentConnectionRegistry {
    private readonly platform;
    private readonly path;
    private readonly mutationLock;
    readonly operationScope: string;
    readonly subjectDisplayCache: AgentSubjectDisplayCache;
    constructor(path?: string, platform?: NodeJS.Platform);
    list(): Promise<AgentConnectionProfile[]>;
    current(): Promise<AgentConnectionProfile | undefined>;
    get(connectionKey: string): Promise<AgentConnectionProfile | undefined>;
    getByAlias(aliasValue: string): Promise<AgentConnectionProfile | undefined>;
    upsert(descriptorValue: AgentConnectionDescriptor, options?: {
        alias?: string;
        makeCurrent?: boolean;
        now?: () => Date;
    }): Promise<AgentConnectionProfile>;
    createInstance(descriptorValue: AgentConnectionDescriptor, options?: {
        alias?: string;
        makeCurrent?: boolean;
        now?: () => Date;
        instanceId?: string;
    }): Promise<AgentConnectionProfile>;
    rebind(connectionKey: string, descriptorValue: AgentConnectionDescriptor, options?: {
        now?: () => Date;
    }): Promise<AgentConnectionProfile>;
    setCurrent(connectionKey: string): Promise<void>;
    assignAlias(connectionKey: string, aliasValue: string): Promise<AgentConnectionProfile>;
    remove(connectionKey: string): Promise<void>;
    /**
     * Atomically promotes one already-authorized candidate and retires metadata for Sessions that
     * were successfully revoked. Alias ownership may move only within the same public binding.
     */
    reconcileToSurvivor(survivorConnectionKey: string, options?: {
        retiredConnectionKeys?: string[];
        alias?: string;
        allocateAliasFrom?: string;
        makeCurrent?: boolean;
    }): Promise<AgentConnectionProfile>;
    private read;
    private write;
}
export type AgentConnectionStoreOptions = {
    environment?: NodeJS.ProcessEnv;
    platform?: NodeJS.Platform;
    commandRunner?: CommandRunner;
    /** Host-owned local state namespace; not a user connection field or identity claim. */
    storageNamespace?: string;
    registry?: AgentConnectionRegistry;
    credentialPathFor?: (connectionKey: string) => string;
};
/**
 * Selects isolated credential storage for each connection and tracks only public current-profile
 * metadata. A host may keep many Hub/business/workspace bindings without sharing refresh tokens.
 */
export declare class AgentConnectionStore {
    readonly registry: AgentConnectionRegistry;
    readonly storageNamespace: string | undefined;
    private readonly environment;
    private readonly platform;
    private readonly commandRunner;
    private readonly credentialPathFor;
    constructor(options?: AgentConnectionStoreOptions);
    credentialStore(connectionKey: string): CredentialStore;
    register(descriptor: AgentConnectionDescriptor, options?: {
        alias?: string;
        makeCurrent?: boolean;
        migrateLegacy?: boolean;
    }): Promise<AgentConnectionProfile>;
    registerInstance(descriptor: AgentConnectionDescriptor, options: {
        alias: string;
        makeCurrent?: boolean;
    }): Promise<AgentConnectionProfile>;
    registerStagingInstance(descriptor: AgentConnectionDescriptor): Promise<AgentConnectionProfile>;
    withBindingLock<T>(descriptorValue: AgentConnectionDescriptor, work: () => Promise<T>): Promise<T>;
    save(credentialsValue: AgentCredentials, options?: {
        alias?: string;
        allowInsecureHttp?: boolean;
        makeCurrent?: boolean;
    }): Promise<AgentConnectionProfile>;
    load(connectionKey?: string): Promise<{
        profile: AgentConnectionProfile;
        credentials: AgentCredentials;
        store: CredentialStore;
    }>;
    migrateLegacy(profile: AgentConnectionProfile): Promise<LegacyCredentialMigrationResult>;
}
//# sourceMappingURL=connections.d.ts.map