import type { GatewayOptions } from "@aotter/mantle/contracts";
/** Optional Admin API: generated data and native calls, with one fresh admin session per request. */
import { type Caller, type Target, type Authorize, type Gateway, type RequestContext } from "@aotter/mantle/contracts";
import { body } from "@aotter/mantle/rest";
import { type Conversions } from "@aotter/mantle/surface";
import { type MantleSite, type MediaStorage } from "@aotter/mantle/site";
export type Admin = (Extract<Caller, {
    kind: "user";
}> & {
    readonly admin: true;
    readonly credential: "session";
}) | (Extract<Caller, {
    kind: "host";
}> & {
    readonly admin: true;
});
export interface Context<Env, Database> {
    request: Request;
    url: URL;
    env: Env;
    db: Database;
    caller: Admin;
    params: Record<string, string>;
    input?: Record<string, unknown>;
    /** Request-bound application gate for related collection reads. */
    authorize?: (target: Target) => Promise<boolean>;
}
export interface Route<Env, Database> {
    readonly target?: (context: Context<Env, Database>) => Target;
    readonly prepare?: (context: Context<Env, Database>) => void | Promise<void>;
    readonly method: string;
    /** Relative to /admin/api; {name} captures one segment, {name*} captures a suffix. */
    readonly path: string;
    readonly bodyLimit?: number;
    readonly rawBody?: boolean;
    readonly preserveCacheControl?: boolean;
    run(context: Context<Env, Database>): Promise<unknown> | unknown;
}
export interface IdentityUser {
    id: string;
    email: string;
    name: string;
    role: string | null;
    githubLogin: string | null;
    emailVerified: boolean;
    createdAt: Date;
}
export interface IdentityMethods {
    readonly adminRoles?: readonly string[];
    listUsers(): Promise<readonly IdentityUser[]>;
    listMembers(args: {
        search?: string;
        limit?: number;
        cursor?: string;
        cursorDirection?: "forward" | "backward";
    }): Promise<{
        items: readonly (Pick<IdentityUser, "id" | "email" | "name" | "emailVerified" | "createdAt"> & {
            role?: string | null;
        })[];
        previousCursor: string | null;
        nextCursor: string | null;
    }>;
    setUserRole(id: string, role: string | null): Promise<boolean>;
    inviteUser(email: string, role?: string): Promise<{
        kind: "created" | "exists";
        id: string;
    }>;
    revokeInvite(id: string): Promise<boolean>;
}
export interface Options<Env, Database> extends GatewayOptions {
    authorize?: Authorize;
    gateway?: Gateway;
    fields?: import("@aotter/mantle/user-fields").UserFields;
    locale?: string;
    /** Read-only developer preview bindings, including public Views. */
    developerViews?: readonly View<Database>[];
    db: (env: Env) => Database;
    caller?: (request: Request, env: Env) => Caller | Promise<Caller>;
    getUser?: (subject: string, request: Request, env: Env) => Promise<{
        githubLogin?: string | null;
        name?: string | null;
        email?: string | null;
        image?: string | null;
    } | null>;
    site?: (db: Database, caller: Caller) => MantleSite;
    media?: MediaStorage;
    identity?: {
        directory?: (context: Context<Env, Database>) => Partial<IdentityMethods> | Promise<Partial<IdentityMethods>>;
        roles?: {
            sendAdminInvitation?: (email: string, role: string) => Promise<void>;
        };
    };
    mcpEndpoints?: {
        public?: string | null;
        admin?: string | null;
    };
    routes?: readonly Route<Env, Database>[];
}
export interface Descriptor {
    readonly name: string;
    readonly [key: string]: unknown;
}
export interface Metadata {
    readonly accessTargets?: GatewayOptions["accessTargets"];
    readonly userFields?: import("@aotter/mantle/user-fields").UserFields;
    /** Generated requires guards for metadata targets beyond callable Admin routes. */
    readonly allows?: (target: Target, caller: Caller) => boolean;
    readonly collections: readonly Descriptor[];
    readonly allCollections?: Readonly<Record<string, Descriptor>>;
    readonly views: readonly Descriptor[];
    readonly operations: readonly Descriptor[];
    readonly webmcp: unknown;
    /** The developer snapshot, or a function that loads it (generated output imports it on first use, outside Worker startup). */
    readonly developerConsole?: unknown;
}
export interface View<Database> {
    readonly name: string;
    readonly check?: (caller: Caller) => void;
    readonly allows: (caller: Caller) => boolean;
    /** Generated query validation also owns selected search/filter inputs. */
    readonly query: (params: URLSearchParams) => {
        input: Record<string, unknown>;
        limit?: number;
        cursor?: string;
        match?: Record<string, unknown>;
    };
    readonly page: (db: Database, caller: Caller, input: never, paging: {
        limit?: number;
        cursor?: string;
        match?: Record<string, unknown>;
    }) => Promise<{
        rows: readonly Record<string, unknown>[];
        nextCursor?: string;
    }>;
    readonly convert?: Conversions;
    readonly row?: (row: Record<string, unknown>) => Record<string, unknown>;
}
export interface Operation<Database, Handlers> {
    readonly readOnly?: boolean;
    readonly name: string;
    readonly check?: (caller: Caller) => void;
    readonly allows: (caller: Caller) => boolean;
    readonly validate: (raw: unknown) => Record<string, unknown>;
    readonly convert?: Conversions;
    readonly run: (db: Database, caller: Caller, input: never, handlers: Handlers) => Promise<unknown>;
}
export { body };
/** JSON was bounded by the shared router before acquiring the database. */
export declare const json: (context: Context<unknown, unknown>) => Promise<Record<string, unknown>>;
export declare function admin<Env, Database, Handlers = never>(metadata: Metadata, views: readonly View<Database>[], operations: readonly Operation<Database, Handlers>[], options: Options<Env, Database> & {
    handlers?: Handlers;
}): (request: Request, env: Env, ctx?: RequestContext) => Promise<Response | undefined>;
export { adminShell } from "./shell.js";