import type Database from 'better-sqlite3-multiple-ciphers';
/**
 * Aegis user roles — three tiers of access control:
 * - **admin**: Full access — manage credentials, agents, policies, users, webhooks, vaults
 * - **operator**: Operational access — start/stop Gate, view Ledger, manage agents
 * - **viewer**: Read-only — view Ledger, stats, and credential metadata (no secrets)
 */
export type UserRole = 'admin' | 'operator' | 'viewer';
export declare const VALID_ROLES: readonly UserRole[];
/**
 * Permission categories that map to CLI commands/actions.
 * Each role grants a different set of permissions.
 */
export type Permission = 'vault:read' | 'vault:write' | 'vault:manage' | 'agent:read' | 'agent:write' | 'ledger:read' | 'ledger:export' | 'gate:start' | 'policy:read' | 'policy:write' | 'webhook:read' | 'webhook:write' | 'user:read' | 'user:write' | 'dashboard:view' | 'doctor:run';
/**
 * Check if a role has a specific permission.
 */
export declare function hasPermission(role: UserRole, permission: Permission): boolean;
/**
 * Get all permissions for a role.
 */
export declare function getPermissions(role: UserRole): ReadonlySet<Permission>;
export interface User {
    id: string;
    name: string;
    role: UserRole;
    tokenPrefix: string;
    createdAt: string;
    updatedAt: string;
}
export interface UserWithToken extends User {
    token: string;
}
/**
 * User Registry — manages user identities, authentication, and role-based access control.
 *
 * Users are authenticated via API keys (same pattern as agent tokens):
 * - Token format: aegis_user_{uuid}_{hmac_prefix}
 * - Tokens are SHA-256 hashed for fast lookup — hash-only, no recovery
 * - Prefixed (first 17 chars: "aegis_user_" + 6) for safe logging
 *
 * Security: Same hash-only storage as agent tokens. If a token is lost,
 * use regenerateToken() to issue a new one.
 */
export declare class UserRegistry {
    private db;
    private derivedKey;
    constructor(db: Database.Database, derivedKey: Buffer);
    /**
     * Register a new user. Returns the user with their API key (shown once).
     *
     * Token format: aegis_user_{uuid}_{hmac_prefix}
     */
    add(params: {
        name: string;
        role: UserRole;
    }): UserWithToken;
    /**
     * List all registered users (without tokens).
     */
    list(): User[];
    /**
     * Get a user by name (without token).
     */
    getByName(name: string): User | null;
    /**
     * Validate a user API key. Returns the user if the token is valid, null otherwise.
     *
     * Uses SHA-256 hash comparison for O(1) lookup.
     */
    validateToken(token: string): User | null;
    /**
     * Remove a user by name.
     */
    remove(name: string): boolean;
    /**
     * Update a user's role.
     */
    updateRole(params: {
        name: string;
        role: UserRole;
    }): User;
    /**
     * Regenerate a user's token. Issues a new token, invalidates the old one.
     *
     * The user keeps their identity (id, name, role).
     * Only the token changes.
     *
     * Returns the user with the new token (shown once), or null if not found.
     */
    regenerateToken(name: string): UserWithToken | null;
    /**
     * Check if a user has a specific permission.
     */
    checkPermission(name: string, permission: Permission): boolean;
    /**
     * Count users. Used by init to determine if initial admin setup is needed.
     */
    count(): number;
    private rowToUser;
}
//# sourceMappingURL=user.d.ts.map