import type { IncomingMessage } from "node:http";
declare const GRANT_PURPOSE = "control-ui-login";
export declare const CONTROL_UI_LOGIN_DEFAULT_GRANT_TTL_MS: number;
export declare const CONTROL_UI_LOGIN_DEFAULT_IDLE_TIMEOUT_MS: number;
export declare const CONTROL_UI_LOGIN_DEFAULT_MAX_LIFETIME_MS: number;
type LoginGrantClaims = {
    v: 1;
    purpose: typeof GRANT_PURPOSE;
    jti: string;
    iat: number;
    exp: number;
    host: string;
};
export type LoginGrantVerifyError = "invalid_grant" | "expired_grant" | "host_mismatch" | "unsupported_grant";
export type LoginGrantVerifyResult = {
    ok: true;
    claims: LoginGrantClaims;
} | {
    ok: false;
    code: LoginGrantVerifyError;
};
export type LoginGrantExchangeError = "invalid_grant" | "expired_grant" | "host_mismatch" | "invalid_or_used_grant";
export type LoginGrantExchangeResult = {
    ok: true;
    sessionToken: string;
    expiresAtMs: number;
    idleTimeoutMs: number;
} | {
    ok: false;
    code: LoginGrantExchangeError;
};
export type SessionTokenAuthError = "invalid_session_token" | "expired_session_token" | "invalid_session_host";
export type SessionTokenAuthResult = {
    ok: true;
    expiresAtMs: number;
} | {
    ok: false;
    code: SessionTokenAuthError;
};
export type SessionTokenRevokeError = "invalid_session_token" | "invalid_session_host";
export type SessionTokenRevokeResult = {
    ok: true;
} | {
    ok: false;
    code: SessionTokenRevokeError;
};
export type SessionTokenIssueResult = {
    ok: true;
    sessionToken: string;
    expiresAtMs: number;
    idleTimeoutMs: number;
} | {
    ok: false;
    code: "invalid_session_host";
};
export declare function normalizePublicHost(raw: string): string;
export declare function resolveControlUiPublicHost(req: IncomingMessage | undefined, trustedProxies?: string[], options?: {
    allowLoopbackHttpsOriginFallback?: boolean;
}): string;
export declare function resolveControlUiLoginStatePath(env?: NodeJS.ProcessEnv): string;
export declare function createLoginGrant(params: {
    gatewayToken: string;
    host: string;
    nowMs?: number;
    ttlMs?: number;
}): string;
export declare function verifyLoginGrant(params: {
    grant: string;
    gatewayToken: string;
    host: string;
    nowMs?: number;
}): LoginGrantVerifyResult;
export declare class ControlUiLoginService {
    private readonly statePath;
    private readonly gatewayToken;
    private readonly idleTimeoutMs;
    private readonly maxLifetimeMs;
    private state;
    constructor(params: {
        gatewayToken: string;
        statePath?: string;
        idleTimeoutMs?: number;
        maxLifetimeMs?: number;
        env?: NodeJS.ProcessEnv;
    });
    createLoginGrant(params: {
        host: string;
        ttlMs?: number;
        nowMs?: number;
    }): string;
    exchangeGrant(params: {
        grant: string;
        host: string;
        nowMs?: number;
    }): LoginGrantExchangeResult;
    issueSession(params: {
        host: string;
        nowMs?: number;
    }): SessionTokenIssueResult;
    authorizeSessionToken(params: {
        token: string;
        host: string;
        nowMs?: number;
    }): SessionTokenAuthResult;
    revokeSessionToken(params: {
        token: string;
        host: string;
        nowMs?: number;
    }): SessionTokenRevokeResult;
    private createSession;
    private loadState;
    private readState;
    private persistState;
}
export {};
