/**
 * Authentication introspection.
 *
 * Three surfaces over the configured tier model and the actual
 * per-user enrollment state:
 *
 * 1. **Vault-wide English summary** — {@link describeAuthConfig}.
 * 2. **Vault-wide Mermaid diagram** — {@link diagramAuthConfig}.
 * 3. **Per-user introspection** — {@link describeUserAuth}, gated by
 *    the `view-user-auth` policy gate (off by default).
 *
 * The per-user surface is held to a strict allowlist — fields not on
 * the allowlist are dropped, never rendered. The negative test in
 * `auth-introspection.test.ts` exercises the allowlist by feeding a
 * contrived keyring with fake "secret" fields and asserting that none
 * of them appear in the output.
 *
 * @module
 */
import type { NoydbStore } from '../../kernel/types.js';
/** Vault-wide English summary of the configured authentication graph. */
export declare function describeAuthConfig(store: NoydbStore, vault: string): Promise<string>;
/**
 * Render the vault's auth graph as Mermaid `flowchart TB` source. The
 * caller pipes this through Mermaid (CLI or browser) to get an SVG.
 */
export declare function diagramAuthConfig(store: NoydbStore, vault: string): Promise<string>;
/**
 * Render the per-user enrollment summary. Returns an empty
 * (non-throwing) string when the user has no keyring file — never
 * confirms or denies the existence of the user from the document
 * alone.
 *
 * Sanitization is strict: only the slot list, enrollment dates, and
 * recovery-profile counts are rendered. WebAuthn cred ids, OIDC
 * subject ids, password hashes, recovery codes, TOTP secrets — all
 * dropped at the allowlist boundary, not redacted.
 */
export declare function describeUserAuth(store: NoydbStore, vault: string, userId: string): Promise<string>;
/** Bulk variant for owner dashboards. */
export declare function describeAllUsersAuth(store: NoydbStore, vault: string): Promise<Array<{
    userId: string;
    description: string;
}>>;