export interface ExactChatGrantDaemon {
    ipcPort: number;
    larkAppId: string;
}
export interface ExactChatGrantClientInput {
    daemon: ExactChatGrantDaemon;
    secret: string;
    receiverLarkAppId: string;
    chatId: string;
    operation?: 'grant' | 'revoke' | 'readback';
    subjectOpenIds?: string[];
    subjectLarkAppIds?: string[];
}
export declare class ExactChatGrantClientError extends Error {
    readonly status?: number | undefined;
    readonly body?: Record<string, unknown> | undefined;
    constructor(message: string, status?: number | undefined, body?: Record<string, unknown> | undefined);
}
/**
 * Call a receiver daemon's HMAC-protected exact-grant endpoint.
 *
 * `subjectLarkAppIds` is resolved inside the receiver daemon so app-scoped
 * open_ids never cross receiver boundaries. The endpoint still performs a
 * live membership check before persisting the talk-only grant.
 */
export declare function requestExactChatGrant(input: ExactChatGrantClientInput, fetchImpl?: typeof fetch): Promise<Record<string, any>>;
export interface BotChatGrantMatrixDeps {
    findDaemon(larkAppId: string): ExactChatGrantDaemon | null;
    secret: string;
    request?: typeof requestExactChatGrant;
    retryDelaysMs?: number[];
}
export interface BotChatGrantMatrixResult {
    ok: true;
    chatId: string;
    participants: string[];
    receivers: Array<{
        receiverLarkAppId: string;
        subjectLarkAppIds: string[];
    }>;
}
/**
 * Establish a full-mesh, talk-only grant matrix for local bots in one chat.
 * Every receiver resolves the other stable app ids in its own Lark namespace.
 * The operation is idempotent; any unresolved/offline receiver fails closed.
 */
export declare function ensureBotChatGrantMatrix(chatId: string, rawParticipantAppIds: string[], deps: BotChatGrantMatrixDeps): Promise<BotChatGrantMatrixResult>;
//# sourceMappingURL=exact-chat-grant-client.d.ts.map