/**
 * Daemon token rotation, persistence, and middleware.
 *
 * Manages the lifecycle of filesystem-resident daemon tokens: writing to disk,
 * rotation on an interval, and HTTP middleware for authentication.
 *
 * Pure token primitives (schema, generation, validation) live in `auth/daemon_token.ts`.
 * See docs/identity.md for design rationale.
 *
 * @module
 */
import type { MiddlewareHandler } from 'hono';
import type { Logger } from '@fuzdev/fuz_util/log.js';
import { type FsWriteDeps, type FsRemoveDeps, type EnvDeps } from '../runtime/deps.js';
import type { QueryDeps } from '../db/query_deps.js';
import { type DaemonTokenState } from './daemon_token.js';
/** Default rotation interval in milliseconds (30 seconds). */
export declare const DEFAULT_ROTATION_INTERVAL_MS = 30000;
/** Deps for writing the daemon token to disk. */
export type DaemonTokenWriteDeps = Pick<EnvDeps, 'env_get'> & Pick<FsWriteDeps, 'mkdir' | 'write_text_file' | 'rename'> & {
    /** Set file permissions. Optional — consumers provide when available (e.g. `Deno.chmod`). */
    chmod?: (path: string, mode: number) => Promise<void>;
};
/**
 * Get the daemon token file path (`~/.{name}/run/daemon_token`).
 *
 * @param runtime - runtime with `env_get` capability
 * @param name - application name
 * @returns path to `daemon_token`, or `null` if `$HOME` is not set
 */
export declare const get_daemon_token_path: (runtime: Pick<EnvDeps, "env_get">, name: string) => string | null;
/**
 * Write the current token to disk atomically.
 *
 * Uses `write_file_atomic` (temp file + rename) and optionally sets mode 0600.
 *
 * On-disk format is JSON `{"token": "..."}` — the wrapper leaves room for
 * future fields (rotated_at, version) without changing every reader. Both
 * the TS cross-backend harness reader (`spawn_backend.read_daemon_token`)
 * and the Rust daemon-token writer match this shape.
 *
 * @param runtime - runtime with file write capabilities
 * @param token_path - path to write the token
 * @param token - the raw token string
 * @mutates filesystem - writes `token_path` atomically and `chmod 0600` when supported
 */
export declare const write_daemon_token: (runtime: DaemonTokenWriteDeps, token_path: string, token: string) => Promise<void>;
/**
 * Resolve the keeper account ID by querying for the account with an active
 * keeper role_grant.
 *
 * There is exactly one keeper account (the bootstrap account). Runs once
 * at server startup — the result is cached in
 * `DaemonTokenState.keeper_account_id`. The acting actor is resolved
 * per-request by the dispatcher's authorization phase (which runs
 * `resolve_acting_actor` against this account id), so multi-actor keeper
 * accounts surface `actor_required` if a daemon caller doesn't pass an
 * explicit `acting`.
 *
 * @param deps - query dependencies
 * @returns the keeper account ID, or `null` if no keeper exists yet (pre-bootstrap)
 */
export declare const resolve_keeper_account_id: (deps: QueryDeps) => Promise<string | null>;
/** Options for daemon token rotation. */
export interface DaemonTokenRotationOptions {
    /**
     * Absolute path the token file is written to. Caller computes from
     * its own conventions — e.g. `get_daemon_token_path(runtime, app_name)`
     * for the standard `~/.{name}/run/daemon_token` layout, or a path
     * derived from `PUBLIC_<APP>_DIR` for cross-process test setups that
     * isolate the app dir to a tmpdir.
     */
    token_path: string;
    /** Rotation interval in ms. Default: `30000` (30s). */
    rotation_interval_ms?: number;
}
/** Result of starting daemon token rotation. */
export interface DaemonTokenRotation {
    /** The mutable runtime state. Pass to `create_daemon_token_middleware`. */
    state: DaemonTokenState;
    /** Stop rotation, clean up the interval, and delete the token file. Call on graceful shutdown. */
    stop: () => Promise<void>;
}
/**
 * Start daemon token rotation.
 *
 * Generates an initial token, writes it to disk, resolves the keeper account,
 * and sets up periodic rotation. Returns the mutable state object and a stop function.
 *
 * @param runtime - runtime with file and remove capabilities
 * @param deps - query dependencies for resolving keeper account
 * @param options - rotation configuration
 * @param log - the logger instance
 * @returns rotation state and stop function
 * @mutates filesystem - writes the token file on each rotation; `stop` removes it
 */
export declare const start_daemon_token_rotation: (runtime: DaemonTokenWriteDeps & FsRemoveDeps, deps: QueryDeps, options: DaemonTokenRotationOptions, log: Logger) => Promise<DaemonTokenRotation>;
/**
 * Create middleware that authenticates via daemon token.
 *
 * Checks the `X-Daemon-Token` header. Behavior:
 * - No header: pass through (don't touch existing context).
 * - Header present + Zod-invalid: return 401 (fail-closed).
 * - Header present + invalid value: return 401 (fail-closed, no downgrade).
 * - Header present + valid + `keeper_account_id` null: return 503.
 * - Header present + valid + ok: set `c.var.auth_account_id =
 *   state.keeper_account_id`, `CREDENTIAL_TYPE_KEY = 'daemon_token'`
 *   (overrides any existing session / bearer identity).
 *
 * Acting-actor resolution + `RequestContext` construction are deferred
 * to the dispatcher's authorization phase. Multi-actor keeper accounts
 * surface `actor_required` from there if a daemon caller doesn't pass
 * an explicit `acting` value.
 *
 * @param state - the daemon token runtime state
 * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, and `AUTH_API_TOKEN_ID_KEY` on a valid token
 */
export declare const create_daemon_token_middleware: (state: DaemonTokenState, deps: QueryDeps) => MiddlewareHandler;
//# sourceMappingURL=daemon_token_middleware.d.ts.map