/**
 * Supported Identity Provider types.
 *
 * Canonical values match the API spec: `eidas_eudi`, `entra_id`, `auth0`, `okta`.
 * Legacy aliases (`azure-ad`, `eudi-wallet`) are kept for backwards compatibility
 * but should not be used in new code.
 */
export type IdPType = "eidas_eudi" | "entra_id" | "auth0" | "okta" | "azure-ad" | "eudi-wallet" | "eidas_wallet" | "google" | "saml" | "oidc";
/** Configuration for a single identity provider within a widget (credentials, domain, and provider-specific fields). */
export interface IdPConfig {
    enabled?: boolean;
    type?: string;
    clientId?: string;
    clientSecret?: string;
    domain?: string;
    tenantId?: string;
    orgId?: string;
    orgUrl?: string;
    metadataUrl?: string;
    [key: string]: unknown;
}
/**
 * Full tenant-side configuration for an embeddable Mandaitor widget: identity
 * providers, taxonomy libraries, mandate templates, constraint defaults,
 * branding, and approval/webhook settings.
 */
export interface WidgetConfiguration {
    widgetId?: string;
    configVersion?: number;
    idpConfigs: Record<string, IdPConfig>;
    availableIdPs: string[];
    taxonomyLibraries: string[];
    mandateTemplates: {
        id: string;
        name: string;
        description: string;
        taxonomy: string;
        actions: string[];
    }[];
    scopeRestrictions: string[];
    constraintDefaults: {
        maxDuration: number;
        maxDelegationDepth: number;
        requireMfa: boolean;
        requireGeoFence?: boolean;
    };
    branding: {
        logoUrl: string;
        primaryColor: string;
        accentColor: string;
        fontFamily?: string;
        consentText: {
            title: string;
            description: string;
            locale: string;
        };
        darkMode: boolean;
        borderRadius: string;
    };
    approvalRequired: boolean;
    approvalWorkflow?: {
        enabled?: boolean;
        mode?: "auto" | "manual" | "conditional";
        notificationChannel?: "email" | "webhook" | "both";
    };
    webhooks?: {
        id?: string;
        url: string;
        events: string[];
        secret?: string;
        active?: boolean;
        retryPolicy?: {
            maxRetries?: number;
            backoffMultiplier?: number;
        };
    }[];
}
/** Lightweight summary of one widget-config version (metadata only, not the full config). */
export interface ConfigVersionSummary {
    configVersion: number;
    updatedAt: string;
    createdAt: string;
    status: string;
    widgetId: string;
    /** Present if this version was created by a rollback operation */
    rollbackFrom?: number;
}
/**
 * Client for managing embeddable-widget configuration. Provides tenant-side
 * methods (get/update config, validate an IdP, list versions, roll back — all
 * requiring a Cognito JWT) and a public method to fetch the safe, secret-free
 * config for embedding.
 */
export declare class MandaitorConfigClient {
    private baseUrl;
    private authToken;
    private tenantId?;
    constructor(baseUrl: string, authToken: string, tenantId?: string | undefined);
    /** Resolve the tenant-scoped widget-config base path */
    private get tenantPath();
    getWidgetConfig(version?: number): Promise<WidgetConfiguration>;
    updateWidgetConfig(config: Partial<WidgetConfiguration>): Promise<{
        version: number;
        widgetId: string;
    }>;
    /**
     * Validate an IdP configuration by attempting a client credentials flow.
     *
     * Sends both `provider` (API spec canonical) and `idpType` (Lambda alias)
     * so the request works regardless of which the server expects.
     *
     * @param provider - The IdP type to validate (e.g. "entra_id", "auth0", "okta", "eidas_eudi")
     * @param config - The IdP-specific configuration object
     */
    validateIdPConfig(provider: string, config: IdPConfig): Promise<{
        valid: boolean;
        message: string;
    }>;
    /**
     * List all configuration versions for the tenant, sorted by version descending.
     * Returns version summaries (not full configs) with pagination.
     */
    listConfigVersions(params?: {
        limit?: number;
        cursor?: string;
    }): Promise<{
        versions: ConfigVersionSummary[];
        next_cursor?: string;
    }>;
    /**
     * Roll back the widget configuration to a previous version.
     *
     * This creates a NEW version that is a copy of the target version,
     * preserving the full version history for audit purposes.
     *
     * @param version - The version number to roll back to
     */
    rollbackConfig(version: number): Promise<{
        version: number;
        rollbackFrom: number;
        widgetId: string;
    }>;
    /**
     * Fetch the public-safe widget configuration for embedding.
     * This endpoint requires no authentication.
     */
    getPublicWidgetConfig(widgetId: string): Promise<PublicWidgetConfig>;
}
/** Public, secret-free view of a widget's configuration, returned to the embeddable widget for rendering. */
export interface PublicWidgetConfig {
    widgetId: string;
    availableIdPs: {
        type: IdPType;
        tenantId?: string;
        domain?: string;
        orgId?: string;
        orgUrl?: string;
        presentationFlow?: {
            mode: string;
        };
        requestedAttributes?: {
            pid: string[];
            eaa: string[];
        };
    }[];
    taxonomyLibraries: string[];
    mandateTemplates: {
        id: string;
        name: string;
        description: string;
        taxonomy: string;
        actions: string[];
    }[];
    scopeRestrictions: string[];
    constraintDefaults: {
        maxDuration: number;
        maxDelegationDepth: number;
        requireMfa: boolean;
    };
    branding: {
        logoUrl: string;
        primaryColor: string;
        accentColor: string;
        fontFamily?: string;
        consentText: {
            title: string;
            description: string;
            locale: string;
        };
        darkMode: boolean;
        borderRadius: string;
    };
    approvalRequired: boolean;
}
//# sourceMappingURL=widget-config.d.ts.map