import * as av from "anyvali";
import type { Infer } from "anyvali";
export declare const TokenTypeSchema: av.EnumSchema<readonly ["access", "refresh", "cp-envelope", "setup", "install"]>;
export type TokenType = Infer<typeof TokenTypeSchema>;
export declare const JwtClaimsSchema: av.ObjectSchema<{
    iss: av.StringSchema;
    aud: av.UnionSchema<[av.StringSchema, av.ArraySchema<av.StringSchema>]>;
    sub: av.StringSchema;
    exp: av.IntSchema;
    iat: av.IntSchema;
    nbf: av.OptionalSchema<av.IntSchema>;
    jti: av.StringSchema;
    realm: av.EnumSchema<readonly ["runtime", "control-plane"]>;
    tenantId: av.StringSchema;
    appId: av.StringSchema;
    roles: av.ArraySchema<av.StringSchema>;
    tokenType: av.EnumSchema<readonly ["access", "refresh", "cp-envelope", "setup", "install"]>;
    authProvider: av.OptionalSchema<av.StringSchema>;
    refreshContext: av.OptionalSchema<av.BaseSchema<unknown, import("./json.js").JsonObject>>;
    providerSubject: av.OptionalSchema<av.StringSchema>;
    provider: av.OptionalSchema<av.ObjectSchema<{
        username: av.OptionalSchema<av.StringSchema>;
        profileUrl: av.OptionalSchema<av.StringSchema>;
        accountId: av.OptionalSchema<av.UnionSchema<[av.StringSchema, av.NumberSchema]>>;
        nodeId: av.OptionalSchema<av.StringSchema>;
        scope: av.OptionalSchema<av.StringSchema>;
    }>>;
    name: av.OptionalSchema<av.StringSchema>;
    email: av.OptionalSchema<av.StringSchema>;
    picture: av.OptionalSchema<av.StringSchema>;
}>;
export type JwtClaims = Infer<typeof JwtClaimsSchema>;
export declare const TokenLifetimeConfigSchema: av.ObjectSchema<{
    accessTokenSeconds: av.IntSchema;
    refreshTokenSeconds: av.IntSchema;
}>;
export type TokenLifetimeConfig = Infer<typeof TokenLifetimeConfigSchema>;
export declare const AuthAudienceRuleSchema: av.ObjectSchema<{
    realm: av.EnumSchema<readonly ["runtime", "control-plane"]>;
    audiences: av.ArraySchema<av.StringSchema>;
}>;
export type AuthAudienceRule = Infer<typeof AuthAudienceRuleSchema>;
export declare const AppAuthPermissionActionSchema: av.EnumSchema<readonly ["read", "create", "update", "delete"]>;
export type AppAuthPermissionAction = Infer<typeof AppAuthPermissionActionSchema>;
export declare const AppAuthPermissionGrantSchema: av.ObjectSchema<{
    serviceId: av.StringSchema;
    viewId: av.StringSchema;
    permissions: av.ArraySchema<av.EnumSchema<readonly ["read", "create", "update", "delete"]>>;
}>;
export type AppAuthPermissionGrant = Infer<typeof AppAuthPermissionGrantSchema>;
export declare const AppAuthRoleSchema: av.ObjectSchema<{
    id: av.StringSchema;
    title: av.StringSchema;
    description: av.OptionalSchema<av.StringSchema>;
    permissions: av.ArraySchema<av.ObjectSchema<{
        serviceId: av.StringSchema;
        viewId: av.StringSchema;
        permissions: av.ArraySchema<av.EnumSchema<readonly ["read", "create", "update", "delete"]>>;
    }>>;
}>;
export type AppAuthRole = Infer<typeof AppAuthRoleSchema>;
export declare const DefaultAuthProviderConfigSchema: av.ObjectSchema<{
    kind: av.LiteralSchema<"betterportal.default">;
}>;
export type DefaultAuthProviderConfig = Infer<typeof DefaultAuthProviderConfigSchema>;
export declare const AuthressProviderConfigSchema: av.ObjectSchema<{
    kind: av.LiteralSchema<"authress.io">;
    roleClaimPath: av.StringSchema;
    subjectClaimPath: av.StringSchema;
    nameClaimPath: av.OptionalSchema<av.StringSchema>;
    emailClaimPath: av.OptionalSchema<av.StringSchema>;
    pictureClaimPath: av.OptionalSchema<av.StringSchema>;
}>;
export type AuthressProviderConfig = Infer<typeof AuthressProviderConfigSchema>;
export declare const AppAuthProviderConfigSchema: av.UnionSchema<[av.ObjectSchema<{
    kind: av.LiteralSchema<"betterportal.default">;
}>, av.ObjectSchema<{
    kind: av.LiteralSchema<"authress.io">;
    roleClaimPath: av.StringSchema;
    subjectClaimPath: av.StringSchema;
    nameClaimPath: av.OptionalSchema<av.StringSchema>;
    emailClaimPath: av.OptionalSchema<av.StringSchema>;
    pictureClaimPath: av.OptionalSchema<av.StringSchema>;
}>]>;
export type AppAuthProviderConfig = Infer<typeof AppAuthProviderConfigSchema>;
export declare const AuthRoleAuthoritySchema: av.EnumSchema<readonly ["provider", "betterportal"]>;
export type AuthRoleAuthority = Infer<typeof AuthRoleAuthoritySchema>;
export declare const RsaPublicJwkSchema: av.ObjectSchema<{
    kty: av.LiteralSchema<"RSA">;
    use: av.LiteralSchema<"sig">;
    alg: av.LiteralSchema<"RS256">;
    kid: av.StringSchema;
    n: av.StringSchema;
    e: av.StringSchema;
}>;
export type RsaPublicJwk = Infer<typeof RsaPublicJwkSchema>;
export declare const PublicJwksSchema: av.ObjectSchema<{
    keys: av.ArraySchema<av.ObjectSchema<{
        kty: av.LiteralSchema<"RSA">;
        use: av.LiteralSchema<"sig">;
        alg: av.LiteralSchema<"RS256">;
        kid: av.StringSchema;
        n: av.StringSchema;
        e: av.StringSchema;
    }>>;
}>;
export type PublicJwks = Infer<typeof PublicJwksSchema>;
export declare const AuthProviderRuntimeMetadataSchema: av.ObjectSchema<{
    issuer: av.StringSchema;
    audience: av.StringSchema;
    jwksUri: av.StringSchema;
    publicKeys: av.OptionalSchema<av.ObjectSchema<{
        keys: av.ArraySchema<av.ObjectSchema<{
            kty: av.LiteralSchema<"RSA">;
            use: av.LiteralSchema<"sig">;
            alg: av.LiteralSchema<"RS256">;
            kid: av.StringSchema;
            n: av.StringSchema;
            e: av.StringSchema;
        }>>;
    }>>;
}>;
export type AuthProviderRuntimeMetadata = Infer<typeof AuthProviderRuntimeMetadataSchema>;
export declare const AppAuthViewReferenceSchema: av.ObjectSchema<{
    serviceId: av.StringSchema;
    viewId: av.StringSchema;
}>;
export type AppAuthViewReference = Infer<typeof AppAuthViewReferenceSchema>;
export declare const AppAuthRedirectsSchema: av.ObjectSchema<{
    afterLogin: av.OptionalSchema<av.ObjectSchema<{
        serviceId: av.StringSchema;
        viewId: av.StringSchema;
    }>>;
    afterLogout: av.OptionalSchema<av.ObjectSchema<{
        serviceId: av.StringSchema;
        viewId: av.StringSchema;
    }>>;
}>;
export type AppAuthRedirects = Infer<typeof AppAuthRedirectsSchema>;
export declare const AppAuthConfigSchema: av.ObjectSchema<{
    serviceId: av.StringSchema;
    provider: av.OptionalSchema<av.UnionSchema<[av.ObjectSchema<{
        kind: av.LiteralSchema<"betterportal.default">;
    }>, av.ObjectSchema<{
        kind: av.LiteralSchema<"authress.io">;
        roleClaimPath: av.StringSchema;
        subjectClaimPath: av.StringSchema;
        nameClaimPath: av.OptionalSchema<av.StringSchema>;
        emailClaimPath: av.OptionalSchema<av.StringSchema>;
        pictureClaimPath: av.OptionalSchema<av.StringSchema>;
    }>]>>;
    roleAuthority: av.OptionalSchema<av.EnumSchema<readonly ["provider", "betterportal"]>>;
    loginViewId: av.OptionalSchema<av.StringSchema>;
    logoutViewId: av.OptionalSchema<av.StringSchema>;
    refreshViewId: av.OptionalSchema<av.StringSchema>;
    redirects: av.OptionalSchema<av.ObjectSchema<{
        afterLogin: av.OptionalSchema<av.ObjectSchema<{
            serviceId: av.StringSchema;
            viewId: av.StringSchema;
        }>>;
        afterLogout: av.OptionalSchema<av.ObjectSchema<{
            serviceId: av.StringSchema;
            viewId: av.StringSchema;
        }>>;
    }>>;
    expectedIssuer: av.StringSchema;
    expectedAudience: av.StringSchema;
    /** Reference URL only - published by the auth service for clients/browsers.
     *  Verifiers MUST use publicKeys (pushed at /install) to avoid CM -> service fetch. */
    jwksUri: av.StringSchema;
    /** Public JWKS pushed by the auth service at /install and on key rotation.
     *  CP-side JWT verification uses these static keys, never fetches jwksUri. */
    publicKeys: av.OptionalSchema<av.ObjectSchema<{
        keys: av.ArraySchema<av.ObjectSchema<{
            kty: av.LiteralSchema<"RSA">;
            use: av.LiteralSchema<"sig">;
            alg: av.LiteralSchema<"RS256">;
            kid: av.StringSchema;
            n: av.StringSchema;
            e: av.StringSchema;
        }>>;
    }>>;
    roles: av.ArraySchema<av.ObjectSchema<{
        id: av.StringSchema;
        title: av.StringSchema;
        description: av.OptionalSchema<av.StringSchema>;
        permissions: av.ArraySchema<av.ObjectSchema<{
            serviceId: av.StringSchema;
            viewId: av.StringSchema;
            permissions: av.ArraySchema<av.EnumSchema<readonly ["read", "create", "update", "delete"]>>;
        }>>;
    }>>;
}>;
export type AppAuthConfig = Infer<typeof AppAuthConfigSchema>;
export declare const TenantAppValidationSchema: av.ObjectSchema<{
    allowed: av.BoolSchema;
    reason: av.OptionalSchema<av.StringSchema>;
    upgradeUrl: av.OptionalSchema<av.StringSchema>;
    retryAfterSeconds: av.OptionalSchema<av.IntSchema>;
}>;
export type TenantAppValidation = Infer<typeof TenantAppValidationSchema>;
export declare const CpEnvelopeClaimsSchema: av.ObjectSchema<{
    iss: av.StringSchema;
    aud: av.StringSchema;
    exp: av.IntSchema;
    iat: av.IntSchema;
    jti: av.StringSchema;
    tokenType: av.LiteralSchema<"cp-envelope">;
    tenantId: av.StringSchema;
    appId: av.StringSchema;
    originUserJti: av.OptionalSchema<av.StringSchema>;
    cpId: av.StringSchema;
    cpJwksUri: av.StringSchema;
}>;
export type CpEnvelopeClaims = Infer<typeof CpEnvelopeClaimsSchema>;
export declare const SetupTokenClaimsSchema: av.ObjectSchema<{
    iss: av.StringSchema;
    exp: av.IntSchema;
    iat: av.IntSchema;
    jti: av.StringSchema;
    tokenType: av.LiteralSchema<"setup">;
    /** UUIDv7 - pre-assigned by CP for this install. Becomes tenant.services[].id. */
    instanceId: av.StringSchema;
    serviceUrl: av.StringSchema;
    cpUrl: av.StringSchema;
    cpJwksUri: av.StringSchema;
    scope: av.OptionalSchema<av.ObjectSchema<{
        tenantId: av.StringSchema;
        appId: av.OptionalSchema<av.StringSchema>;
    }>>;
}>;
export type SetupTokenClaims = Infer<typeof SetupTokenClaimsSchema>;
//# sourceMappingURL=auth.d.ts.map