/** Header carrying a short-lived, read-only dashboard session. */
export declare const DASHBOARD_SESSION_HEADER: "X-LLM-Relay-Dashboard-Session";
export declare const DASHBOARD_SCOPE: "dashboard:read";
export declare const DASHBOARD_BOOTSTRAP_TTL_MS = 60000;
export declare const DASHBOARD_IDLE_TTL_MS: number;
export declare const DASHBOARD_ABSOLUTE_TTL_MS: number;
export type DashboardAuthFailureReason = "missing" | "malformed" | "wrong" | "expired";
export type DashboardAuthErrorCode = "invalid_auth" | "replay";
export interface DashboardAuthFailure {
    readonly ok: false;
    readonly code: DashboardAuthErrorCode;
    readonly reason: DashboardAuthFailureReason | "consumed";
}
export interface DashboardBootstrap {
    readonly ok: true;
    readonly bootstrap: string;
    readonly expiresAt: number;
}
export interface DashboardSession {
    readonly ok: true;
    readonly session: string;
    readonly scope: typeof DASHBOARD_SCOPE;
    readonly idleExpiresAt: number;
    readonly absoluteExpiresAt: number;
}
export interface DashboardSessionValidation {
    readonly ok: true;
    readonly scope: typeof DASHBOARD_SCOPE;
    readonly idleExpiresAt: number;
    readonly absoluteExpiresAt: number;
}
export interface DashboardLogout {
    readonly ok: true;
    readonly revoked: true;
}
export type DashboardBootstrapResult = DashboardSession | DashboardAuthFailure;
export type DashboardSessionResult = DashboardSessionValidation | DashboardAuthFailure;
export type DashboardLogoutResult = DashboardLogout | DashboardAuthFailure;
export interface DashboardAuthOptions {
    /** Milliseconds since Unix epoch. Injected clocks make boundary tests deterministic. */
    readonly clock?: () => number;
    /** Return exactly `size` cryptographically random bytes. */
    readonly randomBytes?: (size: number) => Uint8Array;
    readonly bootstrapTtlMs?: number;
    readonly idleTtlMs?: number;
    readonly absoluteTtlMs?: number;
}
/**
 * Synchronous, in-memory bootstrap/session authority for the analytics dashboard.
 *
 * Only SHA-256 token digests are retained. A new instance starts with no records, so process
 * restart naturally revokes all outstanding bootstraps and sessions.
 */
export declare class DashboardAuthManager {
    #private;
    constructor(options?: DashboardAuthOptions);
    /** Issue a one-time bootstrap capability for the control-authorized launcher. */
    createBootstrap(): DashboardBootstrap;
    /** Issue a direct read-only dashboard session for same-origin browser navigation. */
    createSession(): DashboardSession;
    /** Exchange a live bootstrap exactly once for a read-only dashboard session. */
    exchangeBootstrap(candidate: unknown): DashboardBootstrapResult;
    /** Validate and touch a session's idle expiry, never extending its absolute expiry. */
    validateSession(candidate: unknown): DashboardSessionResult;
    /** Revoke the addressed session. Invalid candidates fail closed without revealing state. */
    logout(candidate: unknown): DashboardLogoutResult;
    /** Remove expired records; safe to call at request boundaries or on a periodic timer. */
    cleanup(at?: number): void;
}
export declare function createDashboardAuthManager(options?: DashboardAuthOptions): DashboardAuthManager;