import type { EdenConfig, UserProfile, UserRole } from "@edenapp/types";
export declare class UserManager {
    private userDirectory;
    private store;
    private initialized;
    private defaultUsername;
    private restrictedApps;
    constructor(config: EdenConfig, appsDirectory: string, userDirectory: string);
    initialize(): Promise<void>;
    listUsers(): Promise<UserProfile[]>;
    getUser(username: string): Promise<UserProfile | null>;
    createUser(args: {
        username?: string;
        name: string;
        role?: UserRole;
        password: string;
        grants?: string[];
        homeDirectory?: string;
    }): Promise<UserProfile>;
    updateUser(args: {
        username: string;
        name?: string;
        role?: UserRole;
        grants?: string[];
        homeDirectory?: string | null;
    }): Promise<UserProfile>;
    deleteUser(username: string): Promise<void>;
    setPassword(username: string, password: string): Promise<UserProfile>;
    changePassword(username: string, currentPassword: string, newPassword: string): Promise<UserProfile>;
    authenticate(username: string, password: string): Promise<UserProfile>;
    getDefaultUsername(): string | null;
    setDefaultUsername(username: string | null): Promise<void>;
    private normalizeUsername;
    private requireUserRecord;
    private toPublicUser;
    private loadDefaultUsername;
    getDefaultUser(): Promise<UserProfile | null>;
    private normalizeUserGrants;
    /**
     * Removes apps/launch/* grants for restricted apps to keep grants tidy.
     * Note: This is cosmetic only - actual restriction is enforced in canLaunchApp()
     * which checks restrictedApps directly, bypassing grants entirely.
     */
    private filterRestrictedAppGrants;
    dispose(): Promise<void>;
}
//# sourceMappingURL=UserManager.d.ts.map