/**
 * Conservative same-period cache for the SSS allowance preflight.
 *
 * The SSS allowance is a 1-day-period resource on the People chain (period =
 * floor(unix_secs / 86_400), UTC-midnight-aligned) plus a chain-side grace
 * window (~2 days, `StmtStoreGraceWindow`). The on-chain value carries NO
 * expiry — expiry is enforced by *pruning* the key at period rollover + grace.
 *
 * We cannot read an authoritative expiry (unlike Bulletin, which stores one),
 * and we must not bake the grace constant into the CLI (it lives in someone
 * else's runtime and already changed once, in people PR #1022). But one fact is
 * stable and safe: an allowance confirmed present during the current period
 * CANNOT be pruned before the period ends (grace only extends validity beyond
 * that). So "valid until the end of the current period" (next UTC midnight) is
 * a STRICT lower bound — it deliberately discards the volatile grace, so it can
 * never over-estimate even if the grace constant changes again.
 *
 * Within that window we skip the (sub-second) People-chain read; after it we
 * fall through to the authoritative `checkSSSAllowance`. The cache is keyed by
 * the statement-signing account so a different session never reads a stale hit.
 *
 * Clock skew: for a fresh grant (claimed this period, valid through +2 days of
 * grace) the period boundary has ~2 days of slack, so skew is immaterial. The
 * one tight case is the oldest still-valid grant — claimed two periods ago, it
 * expires exactly at our boundary — where a local clock running behind chain
 * time gives a skew-sized over-estimate. That residual is covered by the
 * sessionSigner `NoAllowanceError` fast-fail backstop, not by this cache.
 *
 * The marker lives next to the bulletin slot cache (`~/.polkadot-apps`).
 */
/**
 * End of the current SSS 1-day allowance period, in unix seconds. Equals the
 * next UTC-midnight boundary. An allowance present in the current period is
 * valid at least until this instant (grace extends it further), so it is a
 * safe lower bound for skipping the chain read.
 */
declare function sssPeriodEndSec(nowSec: number): number;
/**
 * True when a cached confirmation says THIS account's allowance is valid for
 * the current period — letting the preflight skip the chain read. Conservative:
 * only trusts the cache within the granting period. Any read/parse error or
 * account mismatch → false (fall through to the authoritative check).
 */
declare function isSssAllowanceCacheValid(account: Uint8Array, nowSec?: number, storageDir?: string): Promise<boolean>;
/**
 * Record that THIS account's allowance was confirmed present on-chain; valid
 * (conservatively) until the end of the current 1-day period. Best-effort — a
 * write failure just means the next deploy re-reads the chain.
 */
declare function writeSssAllowanceCache(account: Uint8Array, nowSec?: number, storageDir?: string): Promise<void>;
/**
 * Drop the cached confirmation (e.g. when the chain reports the allowance is
 * gone) so the next preflight re-reads the chain rather than trusting a hit.
 */
declare function clearSssAllowanceCache(storageDir?: string): Promise<void>;
/**
 * Cached SSS allowance preflight, shared by the deploy and login paths.
 *
 *   `true`  — allowance present (same-period cache hit, or chain-confirmed and
 *             cache refreshed)
 *   `false` — chain-confirmed absent/expired (cache cleared); caller should
 *             surface the "run logout/login" guidance
 *   `null`  — no statement account, or People chain unreachable → don't block
 *
 * On a cache hit it skips BOTH the chain read and the endpoint resolution, so
 * `getPeopleEndpoints` is a thunk evaluated only on a miss.
 */
declare function preflightSssAllowance(account: Uint8Array | null, getPeopleEndpoints: () => Promise<string[]>): Promise<boolean | null>;

export { clearSssAllowanceCache, isSssAllowanceCacheValid, preflightSssAllowance, sssPeriodEndSec, writeSssAllowanceCache };