export type HubAuthTokenScopeMode = "subtree" | "self" | "direct_children" | "explicit";
export interface HubAuthTokenScope {
    mode: HubAuthTokenScopeMode;
    rootAgentId: string;
    agentIds?: string[];
}
export interface StoredAuthToken {
    id: string;
    name: string;
    description: string;
    user: string;
    purpose: string;
    scopeRootAgentId: string;
    scope?: HubAuthTokenScope;
    createdByAgentId: string;
    createdAt: string;
    lastUsedAt?: string;
    /**
     * Plaintext token. Authentication is now a direct equality check: scrypt hashing
     * was removed because the root token was already stored in plaintext anyway, so
     * the per-token scrypt cost only delayed `peer:hello` without adding any practical
     * defense beyond filesystem permissions on `.pi/auth.json`.
     */
    token: string;
    root?: boolean;
}
export interface HubAuthFile {
    version: 1;
    tokens: StoredAuthToken[];
}
export interface HubAuthIdentity {
    id: string;
    name: string;
    description: string;
    user: string;
    purpose: string;
    scopeRootAgentId: string;
    scope?: HubAuthTokenScope;
    createdByAgentId: string;
    root: boolean;
}
export interface EnsureRootTokenResult {
    record: StoredAuthToken;
    token: string;
}
export interface CreateScopedTokenInput {
    name: string;
    description: string;
    user: string;
    purpose: string;
    scopeRootAgentId: string;
    scope?: HubAuthTokenScope;
    createdByAgentId: string;
}
export interface CreatedScopedToken {
    record: StoredAuthToken;
    token: string;
}
export declare function isAuthIdentityAllowedForAgent(identity: HubAuthIdentity, targetAgentId: string, isInSubtree: (scopeRootAgentId: string, targetAgentId: string) => boolean, isDirectChild?: (parentAgentId: string, targetAgentId: string) => boolean): boolean;
export declare class HubAuthTokenStore {
    private readonly cwd;
    private readonly path;
    private file;
    /** Plaintext token -> record for O(1) authenticate. */
    private readonly tokensByPlaintext;
    private constructor();
    static open(cwd: string): HubAuthTokenStore;
    ensureRootToken(): EnsureRootTokenResult;
    createScopedToken(input: CreateScopedTokenInput): CreatedScopedToken;
    authenticate(token: string): HubAuthIdentity | undefined;
    getMetadata(tokenId: string): HubAuthIdentity | undefined;
    revokeToken(tokenId: string): HubAuthIdentity | undefined;
    revokeTokensScopedTo(scopeRootAgentIds: Iterable<string>): HubAuthIdentity[];
    listMetadata(): HubAuthIdentity[];
    save(): void;
}
//# sourceMappingURL=token-store.d.ts.map