export type AttachClientPermission = "observe" | "prompt" | "control" | "admin";
export type AttachPairingStatus = "pending" | "approved" | "denied" | "expired" | "revoked";
export interface AttachPairingRequest {
    name?: string;
    userAgent?: string;
    permission?: AttachClientPermission;
    remoteAddress?: string;
    now?: number;
}
export interface AttachPendingClient {
    id: string;
    code: string;
    name: string;
    userAgent?: string;
    remoteAddress?: string;
    permission: AttachClientPermission;
    status: AttachPairingStatus;
    createdAt: number;
    expiresAt: number;
}
export interface AttachApprovedClient extends AttachPendingClient {
    status: "approved";
    clientToken: string;
    approvedAt: number;
}
export type AttachClientRecord = AttachPendingClient | AttachApprovedClient;
export interface AttachPairingRegistryOptions {
    now?: () => number;
    pairingTtlMs?: number;
}
export type AttachAuditAction = "pair_requested" | "pair_approved" | "pair_denied" | "pair_revoked" | "command_allowed" | "command_blocked";
export interface AttachAuditEvent {
    timestamp: number;
    action: AttachAuditAction;
    clientId?: string;
    clientName?: string;
    permission?: AttachClientPermission;
    commandType?: string;
    result: "ok" | "blocked";
}
export declare class AttachPairingRegistry {
    private readonly clients;
    private readonly auditEvents;
    private readonly now;
    private readonly pairingTtlMs;
    constructor(options?: AttachPairingRegistryOptions);
    request(input?: AttachPairingRequest): AttachPendingClient;
    approve(code: string, now?: number): AttachApprovedClient | undefined;
    deny(code: string, now?: number): AttachClientRecord | undefined;
    revoke(id: string): boolean;
    get(id: string, now?: number): AttachClientRecord | undefined;
    list(now?: number): AttachClientRecord[];
    checkToken(token: string | undefined, minimumPermission: AttachClientPermission, commandType: string, now?: number): boolean;
    isTokenAllowed(token: string | undefined, minimumPermission: AttachClientPermission, now?: number): boolean;
    getAuditEvents(): AttachAuditEvent[];
    clear(): void;
    private recordAudit;
    private findPendingByCode;
    private refreshExpiry;
}
//# sourceMappingURL=attach-auth.d.ts.map