type CtxConfig = {
    issuer?: string;
    registryBroker?: string;
} | null;
export interface RegistryGrant {
    scope: string;
    endpoint: string;
    authorizationToken: string;
    expiresAt?: string;
}
export type RegistryBrokerFailure = {
    kind: "no-broker";
} | {
    kind: "no-session";
} | {
    kind: "unauthenticated";
} | {
    kind: "not-authorized";
    email?: string;
    requiredRoles?: string[];
    requestUrl?: string;
} | {
    kind: "unavailable";
    detail: string;
};
export type RegistryBrokerResult = {
    ok: true;
    grant: RegistryGrant;
} | {
    ok: false;
    failure: RegistryBrokerFailure;
};
export declare function resolveRegistryBroker(context: string, getCfg?: (c: string) => CtxConfig): string | null;
export declare const PUBLISHED_BROKER_TIMEOUT_MS = 15000;
export declare const DERIVED_BROKER_TIMEOUT_MS = 4000;
export declare function resolveRegistryBrokerSource(context: string, getCfg?: (c: string) => CtxConfig): {
    url: string | null;
    source: "published" | "derived";
};
export declare function deriveRegistryBroker(context: string, getCfg?: (c: string) => CtxConfig): string | null;
export interface FetchGrantDeps {
    getValidToken: (context: string) => Promise<string | null>;
    fetchFn?: typeof fetch;
    timeoutMs?: number;
}
export declare function classifyBrokerResponse(res: {
    status: number;
    json: () => Promise<unknown>;
}): Promise<RegistryBrokerResult>;
export declare function fetchRegistryGrant(context: string, brokerUrl: string, deps: FetchGrantDeps): Promise<RegistryBrokerResult>;
export declare function realGrantDeps(): FetchGrantDeps;
export {};