/** User-auth composition for the controller-owned stack. It reuses the native preparation that
 *  `up.ts` owns (`authSetup` through `prepareServer`), the auth package's `auth-service` adapter
 *  and child, the provider's own `service.ready({dir, pid})`, and the existing local login read
 *  (`userStatus`). It mints nothing, grants nothing and invents no endpoint.
 *
 *  Limits kept from the native seams, never weakened:
 *  - The auth-service child serves only a registered plain loopback broker (`targetFor` in the
 *    auth adapter). A TLS-required or non-loopback user stack refuses before any effect.
 *  - Readiness and stop of a user stack's manager use the invoking user's signed-in, granted login
 *    (`userViewAuth("manager-caller")`). No static or borrowed caller replaces it. Without that
 *    login the manager is not attempted and the result is a known partial `AUTH_REQUIRED`.
 *  - The registry entry for a first enable is recorded before the auth service exists, because the
 *    adapter resolves a registered user target. It carries only the prepared trust pins and is
 *    reported as incomplete until the provider's readiness for the exact child process answers. */
import { type AuthPrepared } from "@cotal-ai/core";
import { CommandFailure, type UserAuthInfo } from "@cotal-ai/workspace";
import { type ServiceInstanceSnapshot } from "../lib/service-instances.js";
/** The prepared material a user stack's broker preparation returns. Private to this process. */
export interface StackUserPrepared {
    prepared: AuthPrepared;
    stateDir: string;
}
/** The registered user transport the native auth-service child accepts: plain loopback only. */
export declare function assertUserStackTransport(server: string, tlsRequired: boolean): void;
/** The pre-effect half of a first user-auth enable, run before the stack writes any journal,
 *  space trust, broker configuration or registry entry. It reads the provider's existing pin and,
 *  on a first enable, proves the IdP serves a JWKS, through the provider's own read-only
 *  `preflightServer`. A provider without that hook refuses: no check is skipped silently. The
 *  provider's `prepareServer` repeats these checks authoritatively later, so a race is still
 *  caught there and its effects are reported, never rolled back. */
export declare function preflightUserStack(root: string, space: string, idpUrl: string | undefined): Promise<void>;
/** The existing local login and interactive grant for the CLI actor, read without any network.
 *  `ready` means a signed-in login whose locally readable ledger holds a granted CLI row. */
export declare function userLoginState(root: string, space: string): Promise<{
    state: "ready";
} | {
    state: "absent" | "not-granted" | "unreadable";
    idpUrl?: string;
}>;
/** The refusal a user stack reports when the manager cannot be attempted for want of a login. */
export declare function userLoginRequired(space: string, login: Awaited<ReturnType<typeof userLoginState>>): CommandFailure;
/** The provisional registry metadata: the prepared trust pins only. No endpoint is copied from a
 *  declaration or guessed; the auth service's own readiness supplies them afterwards. */
export declare function provisionalUserAuth(setup: StackUserPrepared): UserAuthInfo;
/** Ask the provider whether the exact controller child is serving, bound to that child's
 *  creation-pinned PID. The endpoints come only from the provider's answer, which reads the
 *  daemon's own discovery file and probes `/health`. The PID is checked again afterwards, so a
 *  recycled PID never contributes an endpoint. */
export declare function confirmUserAuthEndpoints(setup: StackUserPrepared, space: string, instance: ServiceInstanceSnapshot): Promise<UserAuthInfo>;
/** Whether the registered entry still lacks the endpoints a confirmed auth service records. */
export declare function userRegistrationIncomplete(space: string): boolean;
//# sourceMappingURL=stack-user-auth.d.ts.map