import * as plugins from '../plugins.js';
import * as data from '../data/index.js';
import * as dto from '../dto/index.js';
export type TSecretDeliveryAlgorithm = 'RSA-OAEP-256';
/** Caller-held RSA public key used to seal one-time secret material. */
export interface ISecretDeliveryRequest {
    algorithm: TSecretDeliveryAlgorithm;
    /** Canonical DER SubjectPublicKeyInfo encoded as standard padded base64. */
    publicKeySpkiBase64: string;
}
/**
 * Durable delivery receipt. Pending envelopes can be retried byte-for-byte
 * until the caller acknowledges their ciphertext hash.
 */
export type TSecretDeliveryEnvelope = {
    operationId: string;
    algorithm: TSecretDeliveryAlgorithm;
    publicKeySha256: string;
    ciphertextSha256: string;
    createdAt: number;
} & ({
    status: 'pending';
    ciphertextBase64: string;
    acknowledgedAt?: never;
} | {
    status: 'acknowledged';
    ciphertextBase64?: never;
    acknowledgedAt: number;
});
type TCreateGlobalAppBaseRequest = {
    jwt: string;
    name: string;
    description: string;
    logoUrl: string;
    appUrl: string;
    category: string;
    redirectUris: string[];
    postLogoutRedirectUris: string[];
    allowedScopes: string[];
    grantTypes: dto.IGlobalAppDto['data']['oauthCredentials']['grantTypes'];
    oidcSettings: dto.IGlobalAppDto['data']['oidcSettings'];
};
export type TCreateGlobalAppRequest = TCreateGlobalAppBaseRequest & ({
    clientType: 'public';
    operationId?: never;
    secretDelivery?: never;
} | {
    clientType: 'confidential';
    /** Caller-stable idempotency key for creation and secret delivery. */
    operationId: string;
    secretDelivery: ISecretDeliveryRequest;
});
/**
 * Check if the current user is a global admin
 */
export interface IReq_CheckGlobalAdmin extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_CheckGlobalAdmin> {
    method: 'checkGlobalAdmin';
    request: {
        jwt: string;
    };
    response: {
        isGlobalAdmin: boolean;
    };
}
/**
 * Get all global apps with statistics (admin only)
 */
export interface IReq_GetGlobalAppStats extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_GetGlobalAppStats> {
    method: 'getGlobalAppStats';
    request: {
        jwt: string;
    };
    response: {
        apps: Array<{
            app: dto.IGlobalAppDto;
            connectionCount: number;
        }>;
    };
}
/**
 * Create a new global app (admin only)
 */
export interface IReq_CreateGlobalApp extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_CreateGlobalApp> {
    method: 'createGlobalApp';
    request: TCreateGlobalAppRequest;
    response: {
        app: dto.IGlobalAppDto;
        secretDelivery?: TSecretDeliveryEnvelope;
    };
}
/**
 * Update an existing global app (admin only)
 */
export interface IReq_UpdateGlobalApp extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_UpdateGlobalApp> {
    method: 'updateGlobalApp';
    request: {
        jwt: string;
        appId: string;
        updates: {
            name?: string;
            description?: string;
            logoUrl?: string;
            appUrl?: string;
            category?: string;
            isActive?: boolean;
            clientType?: dto.IGlobalAppDto['data']['oauthCredentials']['clientType'];
            redirectUris?: string[];
            postLogoutRedirectUris?: string[];
            allowedScopes?: string[];
            grantTypes?: dto.IGlobalAppDto['data']['oauthCredentials']['grantTypes'];
            oidcSettings?: dto.IGlobalAppDto['data']['oidcSettings'];
        };
    };
    response: {
        app: dto.IGlobalAppDto;
    };
}
/**
 * Delete a global app (admin only)
 */
export interface IReq_DeleteGlobalApp extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_DeleteGlobalApp> {
    method: 'deleteGlobalApp';
    request: {
        jwt: string;
        appId: string;
    };
    response: {
        success: boolean;
        disconnectedOrganizations: number;
    };
}
/**
 * Rotate the client secret for a global app while keeping its client ID stable.
 */
export interface IReq_RegenerateAppCredentials extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_RegenerateAppCredentials> {
    method: 'regenerateAppCredentials';
    request: {
        jwt: string;
        appId: string;
        /** Caller-stable idempotency key for this exact rotation request. */
        operationId: string;
        secretDelivery: ISecretDeliveryRequest;
        gracePeriodSeconds?: number;
    };
    response: {
        clientId: string;
        secretDelivery: TSecretDeliveryEnvelope;
        retiringSecretsValidUntil?: number;
    };
}
/**
 * Irreversibly closes a pending encrypted delivery after the caller has
 * decrypted and stored the secret.
 */
export interface IReq_AcknowledgeAppSecretDelivery extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_AcknowledgeAppSecretDelivery> {
    method: 'acknowledgeAppSecretDelivery';
    request: {
        jwt: string;
        appId: string;
        operationId: string;
        ciphertextSha256: string;
    };
    response: {
        acknowledgedAt: number;
    };
}
export interface IReq_RotateOidcSigningKey extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_RotateOidcSigningKey> {
    method: 'rotateOidcSigningKey';
    request: {
        jwt: string;
        /** Caller-stable idempotency key for this exact rotation request. */
        operationId: string;
    };
    response: {
        status: 'pending' | 'completed' | 'expired';
        operationId: string;
        activeKid: string;
        requestedAt: number;
        expiresAt: number;
        /** Present only when a distinct administrator completed the request. */
        approvedAt?: number;
        /** Present only when the request completed and identifies its new active key. */
        resultingActiveKid?: string;
        /** Present only when the request completed. */
        retiringKids?: string[];
    };
}
/**
 * Approve and execute a pending OIDC signing-key rotation requested by a
 * different global administrator.
 */
export interface IReq_ApproveOidcSigningKeyRotation extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_ApproveOidcSigningKeyRotation> {
    method: 'approveOidcSigningKeyRotation';
    request: {
        jwt: string;
        /** Must exactly match the caller-stable id of the pending request. */
        operationId: string;
        /** Binds approval to the key that was active when the request was reviewed. */
        expectedActiveKid: string;
    };
    response: {
        operationId: string;
        activeKid: string;
        retiringKids: string[];
        approvedAt: number;
    };
}
export interface IReq_SetOrganizationSuspension extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_SetOrganizationSuspension> {
    method: 'setOrganizationSuspension';
    request: {
        jwt: string;
        organizationId: string;
        suspended: boolean;
    };
    response: {
        organization: dto.IOrganizationDto;
    };
}
/**
 * Paged, searchable platform user directory (admin only)
 */
export interface IReq_GetGlobalUsers extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_GetGlobalUsers> {
    method: 'getGlobalUsers';
    request: {
        jwt: string;
        /** case-insensitive substring match against name, username and email */
        search?: string;
        limit?: number;
        offset?: number;
    };
    response: {
        users: dto.IGlobalUserAdminDto[];
        total: number;
    };
}
/**
 * Suspend or unsuspend a user account (admin only).
 * Suspension revokes all active sessions and JWTs of the target user.
 */
export interface IReq_SetUserSuspension extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_SetUserSuspension> {
    method: 'setUserSuspension';
    request: {
        jwt: string;
        userId: string;
        suspended: boolean;
    };
    response: {
        user: dto.IGlobalUserAdminDto;
    };
}
/**
 * Grant or remove platform-wide administrator authority.
 * The server enforces fresh strong MFA, distinct actor/target identities,
 * serialized compare-and-set mutation, and the last-active-admin invariant.
 */
export interface IReq_SetGlobalAdmin extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_SetGlobalAdmin> {
    method: 'setGlobalAdmin';
    request: {
        jwt: string;
        /** Caller-stable idempotency key for one grant/removal attempt. */
        operationId: string;
        userId: string;
        /** Exact current User revision the caller reviewed. */
        expectedUserRevision: number;
        isGlobalAdmin: boolean;
    };
    response: {
        user: dto.IGlobalUserAdminDto;
    };
}
/**
 * Replace the direct, delegable platform capabilities of a non-administrator.
 * Non-delegable administrator, deletion, signing-key, and approval authority
 * cannot cross this contract.
 */
export interface IReq_SetGlobalCapabilityAssignments extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_SetGlobalCapabilityAssignments> {
    method: 'setGlobalCapabilityAssignments';
    request: {
        jwt: string;
        /** Caller-stable idempotency key for one exact replacement. */
        operationId: string;
        userId: string;
        /** Exact current User revision the caller reviewed. */
        expectedUserRevision: number;
        capabilities: data.TDelegableGlobalCapability[];
    };
    response: {
        user: dto.IGlobalUserAdminDto;
    };
}
/**
 * Request narrow, temporary platform authority for the authenticated user.
 * Approval by a distinct administrator is required before authority becomes
 * active.
 */
export interface IReq_RequestBreakGlassAccess extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_RequestBreakGlassAccess> {
    method: 'requestBreakGlassAccess';
    request: {
        jwt: string;
        operationId: string;
        /** Exact current revision of the authenticated User. */
        expectedUserRevision: number;
        capabilities: data.TBreakGlassEligibleGlobalCapability[];
        justificationCode: data.TBreakGlassJustificationCode;
        /** Requested active lifetime, from 60 through 1800 seconds. */
        activationDurationSeconds: number;
    };
    response: {
        user: dto.IGlobalUserAdminDto;
    };
}
/** Approve a pending break-glass request from a different user. */
export interface IReq_ApproveBreakGlassAccess extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_ApproveBreakGlassAccess> {
    method: 'approveBreakGlassAccess';
    request: {
        jwt: string;
        operationId: string;
        userId: string;
        /** Exact current revision of the requesting User. */
        expectedUserRevision: number;
    };
    response: {
        user: dto.IGlobalUserAdminDto;
    };
}
/**
 * Close an expired (or deliberately terminated) break-glass grant with a
 * durable post-use review outcome. Calling this before expiry ends access.
 */
export interface IReq_ReviewBreakGlassAccess extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_ReviewBreakGlassAccess> {
    method: 'reviewBreakGlassAccess';
    request: {
        jwt: string;
        operationId: string;
        userId: string;
        /** Exact current revision of the requesting User. */
        expectedUserRevision: number;
        reviewOutcome: data.TBreakGlassReviewOutcome;
    };
    response: {
        user: dto.IGlobalUserAdminDto;
    };
}
/**
 * Request one controlled replacement-passkey enrollment for the authenticated
 * global administrator. The current session must carry a fresh recovery
 * factor, and approval does not grant any ordinary administrator operation.
 */
export interface IReq_RequestAdministratorRecovery extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_RequestAdministratorRecovery> {
    method: 'requestAdministratorRecovery';
    request: {
        jwt: string;
        operationId: string;
        /** Exact current revision of the authenticated global administrator. */
        expectedUserRevision: number;
    };
    response: {
        user: dto.IGlobalUserAdminDto;
    };
}
/**
 * Approve one pending replacement-passkey enrollment for a different global
 * administrator. The approver must use a fresh phishing-resistant factor.
 */
export interface IReq_ApproveAdministratorRecovery extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_ApproveAdministratorRecovery> {
    method: 'approveAdministratorRecovery';
    request: {
        jwt: string;
        operationId: string;
        userId: string;
        /** Exact current revision of the requesting global administrator. */
        expectedUserRevision: number;
    };
    response: {
        user: dto.IGlobalUserAdminDto;
    };
}
/**
 * Platform-wide organization directory with member counts (admin only)
 */
export interface IReq_GetGlobalOrgStats extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_GetGlobalOrgStats> {
    method: 'getGlobalOrgStats';
    request: {
        jwt: string;
        /** case-insensitive substring match against name and slug */
        search?: string;
        limit?: number;
        offset?: number;
    };
    response: {
        orgs: Array<{
            id: string;
            name: string;
            slug: string;
            status: dto.IOrganizationDto['data']['status'];
            memberCount: number;
        }>;
        total: number;
    };
}
export {};