import { MeshCliError } from "./errors.js";
export declare const REGISTRY_ALIAS = "mesh.dev";
export declare const REGISTRY_DOMAIN: string;
export declare const REGISTRY_CREDENTIAL_KEY: string;
export declare function isReservedRegistryContext(context: string): boolean;
export interface RegistryIdentity {
    issuer: string;
    clientId: string;
    registryBroker: string;
    discoveredAt: string;
}
export declare class RegistryIdentityError extends MeshCliError {
    constructor(detail: string);
}
export declare function resolveRegistryIdentity(opts?: {
    refresh?: boolean;
}): Promise<RegistryIdentity>;
export declare function registrySessionCandidates(issuer: string | null, configs?: Record<string, {
    issuer?: string;
} | undefined>, credentials?: Record<string, unknown>): string[];
export interface RegistrySession {
    context: string;
    email: string;
    expiresAt: string;
}
export declare function readRegistrySession(): RegistrySession | null;
export type RegistrySessionFailure = {
    ok: false;
    reason: "no-identity";
    detail: string;
} | {
    ok: false;
    reason: "no-tty";
    detail: string;
} | {
    ok: false;
    reason: "login-failed";
    detail: string;
};
export type RegistrySessionResult = ({
    ok: true;
} & RegistrySession) | RegistrySessionFailure;
export declare function ensureRegistrySession(opts: {
    device?: boolean;
    interactive: boolean;
}): Promise<RegistrySessionResult>;
export declare function registryTokenRoles(idToken: string | null | undefined): string[];
export interface RegistryRemint {
    reminted: boolean;
    rolesChanged: boolean;
}
export declare function refreshRegistrySession(context: string): Promise<RegistryRemint>;
export declare function clearRegistrySession(): void;
export declare function identityChanged(before: RegistryIdentity, after: RegistryIdentity): boolean;
export declare function describeSessionExpiry(expiresAt: string, now?: number): string;
export declare function logRegistryIdentity(identity: RegistryIdentity): void;