import type { CleanupRecord } from './errors.js';
import { type AttachmentRecord } from './identity.js';
import type { AttachmentId, ByteLimit, Capacity, ClientId, GenerationId, IpcOperationCorrelation, IpcVersionAxes, OpaqueId, OwnedBytes, SerializableRecord } from './primitives.js';
import type { BoundedAsyncStream } from './streams.js';
/** Two overlapping bootstraps support React StrictMode handoff without permitting unbounded amplification. */
export declare const ELECTRON_MAX_ACTIVE_RENDERER_LEASES_PER_IDENTITY = 2;
/** Framework-neutral name for the bounded overlapping client lease policy. */
export declare const IPC_MAX_ACTIVE_CLIENT_LEASES_PER_IDENTITY = 2;
/** Trusted-host permissions for security-sensitive desktop IPC operations. */
export type IpcSecurityPermission = 'security:state' | 'security:pair' | 'security:cancel-pairing' | 'security:unpair' | 'security:custom-ceremony';
export interface RendererIdentity<Attachment extends string, Renderer extends string> {
    readonly clientId: ClientId<Attachment, Renderer>;
    readonly windowScope: string;
    readonly sessionScope: string;
}
/** Main-issued lifetime identity for one renderer bootstrap, independent of authenticated sender identity. */
export interface RendererLeaseIdentity {
    readonly leaseId: OpaqueId<'renderer-lease'>;
    readonly generation: GenerationId<'renderer-lease-generation', string>;
}
/** Main-process authentication facts derived from Electron's sender, never renderer input. */
export interface TrustedIpcSender<Attachment extends string, Renderer extends string> {
    readonly authenticatedClientId: ClientId<Attachment, Renderer>;
    readonly authenticatedWindowScope: string;
    readonly authenticatedSessionScope: string;
    /** Derived by the main process; renderer payloads cannot grant or change it. */
    readonly securityPermissions?: readonly IpcSecurityPermission[];
}
/** Framework-neutral aliases used by desktop webview transports such as Tauri. */
export type IpcClientIdentity<Attachment extends string, Client extends string> = RendererIdentity<Attachment, Client>;
export type IpcClientLeaseIdentity = RendererLeaseIdentity;
export type TrustedIpcCaller<Attachment extends string, Client extends string> = TrustedIpcSender<Attachment, Client>;
/** Fixed limits owned by the main process for one attached Electron backend. */
export interface IpcQuota {
    readonly maximumMessageBytes: ByteLimit;
    readonly maximumOutstandingOperations: Capacity;
    readonly maximumRetainedBytes: ByteLimit;
}
/**
 * Untrusted renderer request. Attachment and versions are checked against the
 * main-process authority; renderer code cannot select quotas or other limits.
 */
export interface IpcEnvelope<Attachment extends string, Renderer extends string, Operation extends string> {
    readonly versions: IpcVersionAxes;
    readonly attachment: AttachmentRecord<Attachment>;
    readonly attachmentId: AttachmentId<Attachment>;
    readonly renderer: RendererIdentity<Attachment, Renderer>;
    readonly rendererLease: RendererLeaseIdentity;
    readonly correlation: IpcOperationCorrelation<Attachment, Operation>;
    readonly dispatchEpoch: GenerationId<'ipc-dispatch-epoch', `${Attachment}:${Operation}`>;
    readonly command: string;
    readonly payload: SerializableRecord;
    readonly binaryPayload: OwnedBytes | null;
    readonly quota?: never;
}
export interface RendererSnapshot<Attachment extends string, Renderer extends string> {
    readonly attachment: AttachmentRecord<Attachment>;
    readonly attachmentId: AttachmentId<Attachment>;
    readonly renderer: RendererIdentity<Attachment, Renderer>;
    readonly rebindRequired: true;
    readonly activeLeaseCount: number;
    readonly activeLeases: readonly string[];
    readonly attachmentGeneration: GenerationId<'backend-generation', Attachment>;
    readonly restorable: false;
}
/** Immutable main-process configuration for exactly one attached backend generation. */
export interface ElectronMainArbiterAuthority<Attachment extends string> {
    readonly attachment: AttachmentRecord<Attachment>;
    readonly versions: IpcVersionAxes;
    readonly quota: IpcQuota;
}
/** Routing hooks receive requests only after all authority checks have completed. */
export interface ElectronMainArbiterHandlers<Attachment extends string> {
    route<Renderer extends string, Operation extends string>(envelope: IpcEnvelope<Attachment, Renderer, Operation>): Promise<SerializableRecord>;
    release<Renderer extends string>(identity: RendererIdentity<Attachment, Renderer>, lease: RendererLeaseIdentity): Promise<CleanupRecord>;
}
export interface ElectronMainArbiter<Attachment extends string> {
    registerRenderer<Renderer extends string>(identity: RendererIdentity<Attachment, Renderer>, versions?: IpcVersionAxes): RendererLeaseIdentity;
    route<Renderer extends string, Operation extends string>(sender: TrustedIpcSender<Attachment, Renderer>, envelope: IpcEnvelope<Attachment, Renderer, Operation>): Promise<SerializableRecord>;
    releaseRenderer<Renderer extends string>(sender: TrustedIpcSender<Attachment, Renderer>, lease: RendererLeaseIdentity): Promise<CleanupRecord>;
}
/**
 * Main-process IPC authority. It owns the current full attachment tuple,
 * negotiated version axes, and hard quotas rather than trusting renderer data.
 */
export declare class IpcArbiterContext<Attachment extends string> implements ElectronMainArbiter<Attachment> {
    /**
     * Safety bound on terminal notices retained for renderer replay.
     *
     * A trust-boundary quota, deliberately not renderer-configurable: it bounds
     * how much main-process memory a reloading renderer can pin while it re-reads
     * the terminal outcomes it missed.
     */
    private static readonly maximumTerminalReplayEntries;
    private readonly renderers;
    private readonly authority;
    private readonly handlers;
    private nextRendererLease;
    constructor(authority: ElectronMainArbiterAuthority<Attachment>, handlers: ElectronMainArbiterHandlers<Attachment>);
    registerRenderer<Renderer extends string>(identity: RendererIdentity<Attachment, Renderer>, versions?: IpcVersionAxes, securityPermissions?: readonly IpcSecurityPermission[]): RendererLeaseIdentity;
    route<Renderer extends string, Operation extends string>(sender: TrustedIpcSender<Attachment, Renderer>, envelope: IpcEnvelope<Attachment, Renderer, Operation>): Promise<SerializableRecord>;
    releaseRenderer<Renderer extends string>(sender: TrustedIpcSender<Attachment, Renderer>, lease: RendererLeaseIdentity): Promise<CleanupRecord>;
    private assertRendererDoesNotSupplyAuthority;
    private assertSender;
    private assertSecurityPermissions;
    private assertRegisteredRenderer;
    private assertRendererActive;
    private assertAttachment;
    private assertVersions;
    private prepareEnvelope;
    private requireAccounting;
    private reserveOperation;
    private markReplayTerminal;
    /**
     * Retains settled replay keys only while their exact byte accounting fits the
     * configured renderer budget and the bounded LRU window. A Map's insertion
     * order gives us deterministic eviction without timers or delayed cleanup.
     */
    private trimTerminalReplayLedger;
    private oldestTerminalReplayKey;
}
/** Framework-neutral authority aliases. Electron names remain source-compatible for 4.0 migration. */
export type IpcArbiterAuthority<Attachment extends string> = ElectronMainArbiterAuthority<Attachment>;
export type IpcArbiterHandlers<Attachment extends string> = ElectronMainArbiterHandlers<Attachment>;
export type IpcArbiter<Attachment extends string> = ElectronMainArbiter<Attachment>;
export interface ElectronRendererBoundary<Attachment extends string, Renderer extends string> {
    readonly identity: RendererIdentity<Attachment, Renderer>;
    readonly events: BoundedAsyncStream<SerializableRecord>;
    snapshot(): Promise<RendererSnapshot<Attachment, Renderer>>;
}
//# sourceMappingURL=ipc.d.ts.map