import { type MeshEvent, type MeshIdentity, type MeshStore } from "./store.js";
/**
 * Scoped external grants: a bearer token that lets an outside process append
 * events to exactly one mesh topic. Only the token's SHA-256 is stored, in a
 * private `grants.json` beside the mesh state. Every mutation runs under the
 * mesh lock through {@link MeshStore.transact}, so use counts decrement
 * atomically with the event append. Authority is local file access to the mesh
 * root; the grant narrows what a token holder without that access can do.
 */
export declare const MESH_GRANT_TOKEN_ENV = "PI_FABRIC_MESH_TOKEN";
export declare const MESH_EXTERNAL_DATA_MAX_BYTES: number;
export declare const MESH_GRANT_MIN_TTL_MS = 60000;
export declare const MESH_GRANT_MAX_TTL_MS: number;
export declare const MESH_GRANT_MAX_USES = 10000;
export interface MeshGrantInfo {
    grantId: string;
    topic: string;
    kind?: string;
    createdAt: number;
    expiresAt: number;
    /** Remaining uses. */
    uses: number;
    maxUses: number;
    createdBy: MeshIdentity;
}
export declare const validateMeshKind: (kind: string) => string;
/** Mints a grant; the token is returned once and never persisted. */
export declare function createMeshGrant(store: Pick<MeshStore, "root" | "durable" | "maxEventBytes" | "transact">, input: {
    topic: string;
    kind?: string;
    ttlMs: number;
    uses?: number;
    createdBy: MeshIdentity;
}, now?: number): Promise<{
    grant: MeshGrantInfo;
    token: string;
}>;
export declare function revokeMeshGrant(store: Pick<MeshStore, "root" | "durable" | "transact">, grantId: string, now?: number): Promise<{
    revoked: boolean;
}>;
/** Unexpired grants, never tokens or hashes. */
export declare function listMeshGrants(store: Pick<MeshStore, "root">, now?: number): MeshGrantInfo[];
/**
 * Appends one untrusted external event authorized by `token`. The token hash
 * is compared in constant time against every stored grant, and the use count
 * decrements in the same locked write as the append.
 */
export declare function postWithMeshGrant(store: Pick<MeshStore, "root" | "durable" | "transact">, input: {
    token: string;
    topic?: string;
    kind?: string;
    data?: unknown;
}, now?: number): Promise<{
    event: MeshEvent;
    grant: MeshGrantInfo;
}>;
/**
 * The argv prefix that runs this package's `pi-fabric` CLI. The module may be
 * bundled into a chunk or an entry, so probe the nearby layouts. Source
 * checkouts run the TypeScript entry through Bun.
 */
export declare const meshCliArgv: (moduleUrl?: string) => string[];
/**
 * A ready-to-run `mesh post` line with the token in the environment, not argv:
 * POSIX shell syntax, or PowerShell on Windows where no POSIX shell is assumed.
 */
export declare const meshPostCommand: (argv: readonly string[], input: {
    root: string;
    token: string;
    kind?: string;
}, platform?: NodeJS.Platform) => string;
/**
 * Wraps a durable task script so its exit publishes one notify event through
 * a single-use grant. The original command runs in a subshell, so its own
 * `exit` or traps cannot skip the trailer, and the trailer re-exits with the
 * command's status; a failed post never changes it.
 */
export declare const wrapDurableNotifyScript: (command: string, notify: {
    argv: readonly string[];
    root: string;
    token: string;
    kind: string;
    taskId: string;
    description?: string;
}) => string;
//# sourceMappingURL=grants.d.ts.map