export { ADMIN_ROLE_SLUG } from "./types.js";
export interface WorkOSRoleSpec {
    /** Stable identifier. `isAdmin` matches on this, not on the name. */
    slug: string;
    name?: string;
    description?: string;
}
export interface EnsureRolesResult {
    created: string[];
    existing: string[];
}
/**
 * Create any of YOUR environment roles that are missing. Idempotent, safe on every
 * deploy, and a no-op (no request at all) when you name none.
 *
 * Which environment is decided by `WORKOS_API_KEY`, exactly as the Stripe half is
 * decided by `STRIPE_SECRET_KEY`.
 */
export declare function ensureWorkOSRoles(opts?: {
    roles?: WorkOSRoleSpec[];
}): Promise<EnsureRolesResult>;
/** Roles present in this environment, by slug. Read-only; for the doctor. */
export declare function listWorkOSRoleSlugs(): Promise<string[]>;
/**
 * The AuthKit redirect URI this deployment needs allowlisted.
 *
 * Returned rather than checked: v10 exposes no API for AuthKit's redirect URIs (the
 * SDK's `redirect_uris` belong to Connect applications), so the honest thing is to
 * print the exact string to paste instead of a check that cannot fail.
 */
export declare function oauthCallbackUri(baseUrl: string): string;
//# sourceMappingURL=workos-setup.d.ts.map