/**
 * OpenMDM Core Types
 *
 * These types define the core data structures for the MDM system.
 * Designed to be database-agnostic and framework-agnostic.
 */
type DeviceStatus = 'pending' | 'enrolled' | 'unenrolled' | 'blocked';
interface Device {
    id: string;
    externalId?: string | null;
    enrollmentId: string;
    status: DeviceStatus;
    model?: string | null;
    manufacturer?: string | null;
    osVersion?: string | null;
    serialNumber?: string | null;
    imei?: string | null;
    macAddress?: string | null;
    androidId?: string | null;
    policyId?: string | null;
    agentVersion?: string | null;
    lastHeartbeat?: Date | null;
    lastSync?: Date | null;
    /**
     * Base64-encoded SPKI public key the device registered on first
     * enrollment. Requests from this device can be verified against
     * this key via `verifyDeviceRequest` / `verifyEcdsaSignature` from
     * `@openmdm/core`. `null` on devices that enrolled via the legacy
     * HMAC path and have never been migrated.
     */
    publicKey?: string | null;
    /**
     * How the device originally enrolled. `'hmac'` for the legacy
     * shared-secret path; `'pinned-key'` for the device-pinned ECDSA
     * path. `null` on pre-Phase-2b device rows that predate the
     * column (treated as `'hmac'`).
     */
    enrollmentMethod?: 'hmac' | 'pinned-key' | null;
    batteryLevel?: number | null;
    storageUsed?: number | null;
    storageTotal?: number | null;
    location?: DeviceLocation | null;
    installedApps?: InstalledApp[] | null;
    tags?: Record<string, string> | null;
    metadata?: Record<string, unknown> | null;
    createdAt: Date;
    updatedAt: Date;
}
interface DeviceLocation {
    latitude: number;
    longitude: number;
    accuracy?: number;
    timestamp: Date;
}
interface InstalledApp {
    packageName: string;
    version: string;
    versionCode?: number;
    installedAt?: Date;
}
interface CreateDeviceInput {
    enrollmentId: string;
    externalId?: string;
    model?: string;
    manufacturer?: string;
    osVersion?: string;
    serialNumber?: string;
    imei?: string;
    macAddress?: string;
    androidId?: string;
    policyId?: string;
    tags?: Record<string, string>;
    metadata?: Record<string, unknown>;
}
interface UpdateDeviceInput {
    externalId?: string | null;
    status?: DeviceStatus;
    policyId?: string | null;
    agentVersion?: string | null;
    model?: string;
    manufacturer?: string;
    osVersion?: string;
    batteryLevel?: number | null;
    storageUsed?: number | null;
    storageTotal?: number | null;
    lastHeartbeat?: Date;
    lastSync?: Date;
    installedApps?: InstalledApp[];
    location?: DeviceLocation;
    tags?: Record<string, string>;
    metadata?: Record<string, unknown>;
    /** Phase 2b — pin a new public key on first enroll. */
    publicKey?: string | null;
    /** Phase 2b — record which auth path the device enrolled via. */
    enrollmentMethod?: 'hmac' | 'pinned-key' | null;
}
interface DeviceFilter {
    status?: DeviceStatus | DeviceStatus[];
    policyId?: string;
    groupId?: string;
    search?: string;
    tags?: Record<string, string>;
    limit?: number;
    offset?: number;
}
interface DeviceListResult {
    devices: Device[];
    total: number;
    limit: number;
    offset: number;
}
interface Policy {
    id: string;
    name: string;
    description?: string | null;
    isDefault: boolean;
    settings: PolicySettings;
    createdAt: Date;
    updatedAt: Date;
}
interface PolicySettings {
    kioskMode?: boolean;
    mainApp?: string;
    allowedApps?: string[];
    kioskExitPassword?: string;
    lockStatusBar?: boolean;
    lockNavigationBar?: boolean;
    lockSettings?: boolean;
    lockPowerButton?: boolean;
    blockInstall?: boolean;
    blockUninstall?: boolean;
    bluetooth?: HardwareControl;
    wifi?: HardwareControl;
    gps?: HardwareControl;
    mobileData?: HardwareControl;
    camera?: HardwareControl;
    microphone?: HardwareControl;
    usb?: HardwareControl;
    nfc?: HardwareControl;
    systemUpdatePolicy?: SystemUpdatePolicy;
    updateWindow?: TimeWindow;
    passwordPolicy?: PasswordPolicy;
    encryptionRequired?: boolean;
    factoryResetProtection?: boolean;
    safeBootDisabled?: boolean;
    heartbeatInterval?: number;
    locationReportInterval?: number;
    locationEnabled?: boolean;
    wifiConfigs?: WifiConfig[];
    vpnConfig?: VpnConfig;
    applications?: PolicyApplication[];
    custom?: Record<string, unknown>;
}
type HardwareControl = 'on' | 'off' | 'user';
type SystemUpdatePolicy = 'auto' | 'windowed' | 'postpone' | 'manual';
interface TimeWindow {
    start: string;
    end: string;
}
interface PasswordPolicy {
    required: boolean;
    minLength?: number;
    complexity?: 'none' | 'numeric' | 'alphanumeric' | 'complex';
    maxFailedAttempts?: number;
    expirationDays?: number;
    historyLength?: number;
}
interface WifiConfig {
    ssid: string;
    securityType: 'none' | 'wep' | 'wpa' | 'wpa2' | 'wpa3';
    password?: string;
    hidden?: boolean;
    autoConnect?: boolean;
}
interface VpnConfig {
    type: 'pptp' | 'l2tp' | 'ipsec' | 'openvpn' | 'wireguard';
    server: string;
    username?: string;
    password?: string;
    certificate?: string;
    config?: Record<string, unknown>;
}
interface PolicyApplication {
    packageName: string;
    action: 'install' | 'update' | 'uninstall';
    version?: string;
    required?: boolean;
    autoUpdate?: boolean;
}
interface CreatePolicyInput {
    name: string;
    description?: string;
    isDefault?: boolean;
    settings: PolicySettings;
}
interface UpdatePolicyInput {
    name?: string;
    description?: string | null;
    isDefault?: boolean;
    settings?: PolicySettings;
}
interface Application {
    id: string;
    name: string;
    packageName: string;
    version: string;
    versionCode: number;
    url: string;
    hash?: string | null;
    size?: number | null;
    minSdkVersion?: number | null;
    showIcon: boolean;
    runAfterInstall: boolean;
    runAtBoot: boolean;
    isSystem: boolean;
    isActive: boolean;
    metadata?: Record<string, unknown> | null;
    createdAt: Date;
    updatedAt: Date;
}
interface CreateApplicationInput {
    name: string;
    packageName: string;
    version: string;
    versionCode: number;
    url: string;
    hash?: string;
    size?: number;
    minSdkVersion?: number;
    showIcon?: boolean;
    runAfterInstall?: boolean;
    runAtBoot?: boolean;
    isSystem?: boolean;
    metadata?: Record<string, unknown>;
}
interface UpdateApplicationInput {
    name?: string;
    version?: string;
    versionCode?: number;
    url?: string;
    hash?: string | null;
    size?: number | null;
    minSdkVersion?: number | null;
    showIcon?: boolean;
    runAfterInstall?: boolean;
    runAtBoot?: boolean;
    isActive?: boolean;
    metadata?: Record<string, unknown> | null;
}
interface DeployTarget {
    devices?: string[];
    policies?: string[];
    groups?: string[];
}
interface AppVersion {
    id: string;
    applicationId: string;
    packageName: string;
    version: string;
    versionCode: number;
    url: string;
    hash?: string | null;
    size?: number | null;
    releaseNotes?: string | null;
    isMinimumVersion: boolean;
    createdAt: Date;
}
interface AppRollback {
    id: string;
    deviceId: string;
    packageName: string;
    fromVersion: string;
    fromVersionCode: number;
    toVersion: string;
    toVersionCode: number;
    reason?: string | null;
    status: 'pending' | 'in_progress' | 'completed' | 'failed';
    error?: string | null;
    initiatedBy?: string | null;
    createdAt: Date;
    completedAt?: Date | null;
}
interface CreateAppRollbackInput {
    deviceId: string;
    packageName: string;
    toVersionCode: number;
    reason?: string;
    initiatedBy?: string;
}
type CommandType = 'reboot' | 'shutdown' | 'sync' | 'lock' | 'unlock' | 'wipe' | 'factoryReset' | 'installApp' | 'uninstallApp' | 'updateApp' | 'runApp' | 'clearAppData' | 'clearAppCache' | 'shell' | 'setPolicy' | 'grantPermissions' | 'exitKiosk' | 'enterKiosk' | 'setWifi' | 'screenshot' | 'getLocation' | 'setVolume' | 'sendNotification' | 'whitelistBattery' | 'enablePermissiveMode' | 'setTimeZone' | 'enableAdb' | 'rollbackApp' | 'updateAgent' | 'custom';
type CommandStatus = 'pending' | 'sent' | 'acknowledged' | 'completed' | 'failed' | 'cancelled';
interface Command {
    id: string;
    deviceId: string;
    type: CommandType;
    payload?: Record<string, unknown> | null;
    status: CommandStatus;
    result?: CommandResult | null;
    error?: string | null;
    createdAt: Date;
    sentAt?: Date | null;
    acknowledgedAt?: Date | null;
    completedAt?: Date | null;
}
interface CommandResult {
    success: boolean;
    message?: string;
    data?: unknown;
}
interface SendCommandInput {
    deviceId: string;
    type: CommandType;
    payload?: Record<string, unknown>;
}
interface CommandFilter {
    deviceId?: string;
    status?: CommandStatus | CommandStatus[];
    type?: CommandType | CommandType[];
    limit?: number;
    offset?: number;
}
type EventType = 'device.enrolled' | 'device.unenrolled' | 'device.blocked' | 'device.heartbeat' | 'device.locationUpdated' | 'device.statusChanged' | 'device.policyChanged' | 'app.installed' | 'app.uninstalled' | 'app.updated' | 'app.crashed' | 'app.started' | 'app.stopped' | 'policy.applied' | 'policy.failed' | 'command.received' | 'command.acknowledged' | 'command.completed' | 'command.failed' | 'security.tamper' | 'security.rootDetected' | 'security.screenLocked' | 'security.screenUnlocked' | 'custom';
interface MDMEvent<T = unknown> {
    id: string;
    deviceId: string;
    type: EventType;
    payload: T;
    createdAt: Date;
}
interface EventFilter {
    deviceId?: string;
    type?: EventType | EventType[];
    startDate?: Date;
    endDate?: Date;
    limit?: number;
    offset?: number;
}
interface Group {
    id: string;
    name: string;
    description?: string | null;
    policyId?: string | null;
    parentId?: string | null;
    metadata?: Record<string, unknown> | null;
    createdAt: Date;
    updatedAt: Date;
}
interface CreateGroupInput {
    name: string;
    description?: string;
    policyId?: string;
    parentId?: string;
    metadata?: Record<string, unknown>;
}
interface UpdateGroupInput {
    name?: string;
    description?: string | null;
    policyId?: string | null;
    parentId?: string | null;
    metadata?: Record<string, unknown> | null;
}
type EnrollmentMethod = 'qr' | 'nfc' | 'zero-touch' | 'knox' | 'manual' | 'app-only' | 'adb';
interface EnrollmentRequest {
    macAddress?: string;
    serialNumber?: string;
    imei?: string;
    androidId?: string;
    model: string;
    manufacturer: string;
    osVersion: string;
    sdkVersion?: number;
    agentVersion?: string;
    agentPackage?: string;
    method: EnrollmentMethod;
    timestamp: string;
    /**
     * Signature over the canonical enrollment message.
     *
     * Phase 2a (HMAC path, backwards-compatible): hex-encoded
     * HMAC-SHA256 of the nine-field pipe-delimited canonical form
     * (see `concepts/enrollment`).
     *
     * Phase 2b (device-pinned-key path, preferred): base64-encoded
     * DER ECDSA-P256 signature produced by the device's Keystore
     * private key, over `canonicalEnrollmentMessage(...)` including
     * the public key and challenge. The server distinguishes the
     * two paths by whether `publicKey` is present on the request.
     */
    signature: string;
    /**
     * Base64-encoded SPKI public key (EC P-256) the device generated
     * in its Keystore. When present, enrollment follows the Phase 2b
     * device-pinned-key path and `signature` must verify as an ECDSA
     * signature against this key. The server pins this key on the
     * device row on first successful enroll; any future enroll
     * attempting a different key for the same `enrollmentId` is
     * rejected with `PublicKeyMismatchError`.
     *
     * Omit for the legacy HMAC path. Callers that want to migrate a
     * fleet gradually can run both paths in parallel.
     */
    publicKey?: string;
    /**
     * Opaque challenge issued by `GET /agent/enroll/challenge`. Must
     * be present whenever `publicKey` is present — the server uses
     * it to prevent replay of captured enrollment payloads. The
     * challenge is single-use: the server consumes it on first
     * successful verify.
     */
    attestationChallenge?: string;
    policyId?: string;
    groupId?: string;
}
interface EnrollmentResponse {
    deviceId: string;
    enrollmentId: string;
    policyId?: string;
    policy?: Policy;
    serverUrl: string;
    pushConfig: PushConfig;
    token: string;
    refreshToken?: string;
    tokenExpiresAt?: Date;
}
/**
 * Single-use nonce issued by `GET /agent/enroll/challenge` and
 * consumed on first successful verify of a device-pinned-key
 * enrollment. A persisted record; the `consume*` adapter methods
 * enforce the single-use invariant.
 */
interface EnrollmentChallenge {
    challenge: string;
    expiresAt: Date;
    consumedAt?: Date | null;
    createdAt: Date;
}
/**
 * Result of calling `verifyDeviceRequest`. Callers pattern-match on
 * `ok` and, when `false`, on `reason` to decide their response
 * shape:
 *
 *  - `not-found`         — unknown device id. Return 401.
 *  - `no-pinned-key`     — device exists but never migrated off the
 *                          legacy HMAC path. Caller should fall back
 *                          to their HMAC verifier, or fail if
 *                          they've completed their migration.
 *  - `signature-invalid` — signature did not verify against the
 *                          pinned key. Return 401. Never re-pin
 *                          in response to this.
 */
type DeviceIdentityVerification = {
    ok: true;
    device: Device;
} | {
    ok: false;
    reason: 'not-found';
} | {
    ok: false;
    reason: 'no-pinned-key';
    device: Device;
} | {
    ok: false;
    reason: 'signature-invalid';
    device: Device;
};
interface PushConfig {
    provider: 'fcm' | 'mqtt' | 'websocket' | 'polling';
    fcmSenderId?: string;
    mqttUrl?: string;
    mqttTopic?: string;
    mqttUsername?: string;
    mqttPassword?: string;
    wsUrl?: string;
    pollingInterval?: number;
}
interface Heartbeat {
    deviceId: string;
    timestamp: Date;
    batteryLevel: number;
    isCharging: boolean;
    batteryHealth?: 'good' | 'overheat' | 'dead' | 'cold' | 'unknown';
    storageUsed: number;
    storageTotal: number;
    memoryUsed: number;
    memoryTotal: number;
    networkType?: 'wifi' | 'cellular' | 'ethernet' | 'none';
    networkName?: string;
    signalStrength?: number;
    ipAddress?: string;
    location?: DeviceLocation;
    installedApps: InstalledApp[];
    runningApps?: string[];
    isRooted?: boolean;
    isEncrypted?: boolean;
    screenLockEnabled?: boolean;
    agentVersion?: string;
    policyVersion?: string;
    lastPolicySync?: Date;
}
interface PushToken {
    id: string;
    deviceId: string;
    provider: 'fcm' | 'mqtt' | 'websocket';
    token: string;
    isActive: boolean;
    createdAt: Date;
    updatedAt: Date;
}
interface RegisterPushTokenInput {
    deviceId: string;
    provider: 'fcm' | 'mqtt' | 'websocket';
    token: string;
}
interface MDMConfig {
    /** Database adapter for persistence */
    database: DatabaseAdapter;
    /** Authentication/authorization configuration */
    auth?: AuthConfig;
    /** Push notification provider configuration */
    push?: PushProviderConfig;
    /** Device enrollment configuration */
    enrollment?: EnrollmentConfig;
    /** Server URL (used in enrollment responses) */
    serverUrl?: string;
    /** APK/file storage configuration */
    storage?: StorageConfig;
    /** Outbound webhook configuration */
    webhooks?: WebhookConfig;
    /** Plugins to extend functionality */
    plugins?: MDMPlugin[];
    /** Event handlers */
    onDeviceEnrolled?: (device: Device) => Promise<void>;
    onDeviceUnenrolled?: (device: Device) => Promise<void>;
    onDeviceBlocked?: (device: Device) => Promise<void>;
    onHeartbeat?: (device: Device, heartbeat: Heartbeat) => Promise<void>;
    onCommand?: (command: Command) => Promise<void>;
    onEvent?: (event: MDMEvent) => Promise<void>;
    /** Multi-tenancy configuration */
    multiTenancy?: {
        enabled: boolean;
        defaultTenantId?: string;
        tenantResolver?: (context: unknown) => Promise<string | null>;
    };
    /** Authorization (RBAC) configuration */
    authorization?: {
        enabled: boolean;
        defaultRole?: string;
    };
    /** Audit logging configuration */
    audit?: {
        enabled: boolean;
        retentionDays?: number;
    };
    /** Scheduling configuration */
    scheduling?: {
        enabled: boolean;
        timezone?: string;
    };
    /** Plugin storage configuration */
    pluginStorage?: {
        adapter: 'database' | 'memory';
    };
    /**
     * Structured logger. Replaces OpenMDM's internal `console.*` calls
     * so log output lands in the host application's logging pipeline
     * (pino, winston, bunyan, OTEL collector, etc.) instead of raw
     * stderr.
     *
     * The shape is a strict subset of the pino / winston / bunyan
     * interface — any of those can be passed directly. If omitted, a
     * default logger that writes to the console with an `[openmdm]`
     * prefix is used. To silence OpenMDM entirely, pass a no-op
     * implementation (see `createSilentLogger()` in the package
     * exports).
     */
    logger?: Logger;
}
/**
 * Minimal structured-logger interface OpenMDM calls internally.
 *
 * The shape is deliberately the pino-compatible subset: an optional
 * context object as the first argument followed by a message string.
 * pino, winston, bunyan, and most other structured loggers accept
 * this shape natively.
 *
 * Implementations should be side-effect-free on unconfigured levels
 * (a production logger filtered to `info` should still accept
 * `.debug()` calls cheaply).
 */
interface Logger {
    /** Human-ignorable, high-volume tracing. Off in production by default. */
    debug(context: LogContext, message: string): void;
    debug(message: string): void;
    /** Normal operational events. Enrollment, policy changes, command delivery. */
    info(context: LogContext, message: string): void;
    info(message: string): void;
    /** Something is wrong but the server is still running. Retries, fallbacks, degraded modes. */
    warn(context: LogContext, message: string): void;
    warn(message: string): void;
    /** Something failed and a request/operation did not complete. */
    error(context: LogContext, message: string): void;
    error(message: string): void;
    /**
     * Return a new logger with the given fields attached to every
     * subsequent call. Used by managers and plugins to scope logs to
     * a specific subsystem without repeating context.
     */
    child(bindings: LogContext): Logger;
}
/**
 * Arbitrary structured context attached to a log line. Values must
 * be JSON-serializable so host loggers can ship them to any backend.
 */
type LogContext = Record<string, unknown>;
interface StorageConfig {
    /** Storage provider (s3, local, custom) */
    provider: 's3' | 'local' | 'custom';
    /** S3 configuration */
    s3?: {
        bucket: string;
        region: string;
        accessKeyId?: string;
        secretAccessKey?: string;
        endpoint?: string;
        presignedUrlExpiry?: number;
    };
    /** Local storage path */
    localPath?: string;
    /** Custom storage adapter */
    customAdapter?: {
        upload: (file: Buffer, key: string) => Promise<string>;
        getUrl: (key: string) => Promise<string>;
        delete: (key: string) => Promise<void>;
    };
}
interface WebhookConfig {
    /** Webhook endpoints to notify */
    endpoints?: WebhookEndpoint[];
    /** Retry configuration */
    retry?: {
        maxRetries?: number;
        initialDelay?: number;
        maxDelay?: number;
    };
    /** Sign webhooks with HMAC secret */
    signingSecret?: string;
}
interface WebhookEndpoint {
    /** Unique identifier */
    id: string;
    /** Webhook URL */
    url: string;
    /** Events to trigger this webhook */
    events: (EventType | '*')[];
    /** Custom headers */
    headers?: Record<string, string>;
    /** Whether endpoint is active */
    enabled: boolean;
}
interface AuthConfig {
    /** Get current user from request context */
    getUser: <T = unknown>(context: unknown) => Promise<T | null>;
    /** Check if user has admin privileges */
    isAdmin?: (user: unknown) => Promise<boolean>;
    /** Check if user can access specific device */
    canAccessDevice?: (user: unknown, deviceId: string) => Promise<boolean>;
    /** Device JWT secret (for device auth tokens) */
    deviceTokenSecret?: string;
    /** Device token expiration in seconds (default: 365 days) */
    deviceTokenExpiration?: number;
}
interface PushProviderConfig {
    provider: 'fcm' | 'mqtt' | 'websocket' | 'polling';
    fcmCredentials?: string | Record<string, unknown>;
    fcmProjectId?: string;
    mqttUrl?: string;
    mqttUsername?: string;
    mqttPassword?: string;
    mqttTopicPrefix?: string;
    wsPath?: string;
    wsPingInterval?: number;
    pollingInterval?: number;
}
interface EnrollmentConfig {
    /** Auto-enroll devices with valid signature */
    autoEnroll?: boolean;
    /** HMAC secret for device signature verification (Phase 2a path) */
    deviceSecret: string;
    /** Allowed enrollment methods */
    allowedMethods?: EnrollmentMethod[];
    /** Default policy for new devices */
    defaultPolicyId?: string;
    /** Default group for new devices */
    defaultGroupId?: string;
    /** Require manual approval for enrollment */
    requireApproval?: boolean;
    /** Custom enrollment validation */
    validate?: (request: EnrollmentRequest) => Promise<boolean>;
    /**
     * Phase 2b device-pinned-key configuration. Optional — when
     * omitted, enrollment continues to accept the Phase 2a HMAC path
     * exclusively, matching pre-0.9 behaviour.
     */
    pinnedKey?: PinnedKeyConfig;
}
/**
 * Device-pinned-key enrollment options. See
 * `docs/concepts/enrollment` for the full flow.
 */
interface PinnedKeyConfig {
    /**
     * Require every new enrollment to use the pinned-key path. When
     * `true`, requests without `publicKey` are rejected. When `false`
     * (the default), both paths coexist during rollout — the server
     * pins a public key when one is provided, falls back to HMAC when
     * it isn't.
     */
    required?: boolean;
    /**
     * TTL for enrollment challenges, in seconds. Defaults to 300
     * (5 minutes). Challenges are single-use; this only bounds how
     * long an unused challenge stays valid.
     */
    challengeTtlSeconds?: number;
}
interface DatabaseAdapter {
    findDevice(id: string): Promise<Device | null>;
    findDeviceByEnrollmentId(enrollmentId: string): Promise<Device | null>;
    listDevices(filter?: DeviceFilter): Promise<DeviceListResult>;
    createDevice(data: CreateDeviceInput): Promise<Device>;
    updateDevice(id: string, data: UpdateDeviceInput): Promise<Device>;
    deleteDevice(id: string): Promise<void>;
    countDevices(filter?: DeviceFilter): Promise<number>;
    findPolicy(id: string): Promise<Policy | null>;
    findDefaultPolicy(): Promise<Policy | null>;
    listPolicies(): Promise<Policy[]>;
    createPolicy(data: CreatePolicyInput): Promise<Policy>;
    updatePolicy(id: string, data: UpdatePolicyInput): Promise<Policy>;
    deletePolicy(id: string): Promise<void>;
    findApplication(id: string): Promise<Application | null>;
    findApplicationByPackage(packageName: string, version?: string): Promise<Application | null>;
    listApplications(activeOnly?: boolean): Promise<Application[]>;
    createApplication(data: CreateApplicationInput): Promise<Application>;
    updateApplication(id: string, data: UpdateApplicationInput): Promise<Application>;
    deleteApplication(id: string): Promise<void>;
    findCommand(id: string): Promise<Command | null>;
    listCommands(filter?: CommandFilter): Promise<Command[]>;
    createCommand(data: SendCommandInput): Promise<Command>;
    updateCommand(id: string, data: Partial<Command>): Promise<Command | null>;
    getPendingCommands(deviceId: string): Promise<Command[]>;
    createEvent(event: Omit<MDMEvent, 'id' | 'createdAt'>): Promise<MDMEvent>;
    listEvents(filter?: EventFilter): Promise<MDMEvent[]>;
    findGroup(id: string): Promise<Group | null>;
    listGroups(): Promise<Group[]>;
    createGroup(data: CreateGroupInput): Promise<Group>;
    updateGroup(id: string, data: UpdateGroupInput): Promise<Group>;
    deleteGroup(id: string): Promise<void>;
    listDevicesInGroup(groupId: string): Promise<Device[]>;
    addDeviceToGroup(deviceId: string, groupId: string): Promise<void>;
    removeDeviceFromGroup(deviceId: string, groupId: string): Promise<void>;
    getDeviceGroups(deviceId: string): Promise<Group[]>;
    findPushToken(deviceId: string, provider: string): Promise<PushToken | null>;
    upsertPushToken(data: RegisterPushTokenInput): Promise<PushToken>;
    deletePushToken(deviceId: string, provider?: string): Promise<void>;
    listAppVersions?(packageName: string): Promise<AppVersion[]>;
    createAppVersion?(data: Omit<AppVersion, 'id' | 'createdAt'>): Promise<AppVersion>;
    setMinimumVersion?(packageName: string, versionCode: number): Promise<void>;
    getMinimumVersion?(packageName: string): Promise<AppVersion | null>;
    createRollback?(data: CreateAppRollbackInput): Promise<AppRollback>;
    updateRollback?(id: string, data: Partial<AppRollback>): Promise<AppRollback>;
    listRollbacks?(filter?: {
        deviceId?: string;
        packageName?: string;
    }): Promise<AppRollback[]>;
    getGroupChildren?(parentId: string | null): Promise<Group[]>;
    getGroupAncestors?(groupId: string): Promise<Group[]>;
    getGroupDescendants?(groupId: string): Promise<Group[]>;
    getGroupTree?(rootId?: string): Promise<GroupTreeNode[]>;
    getGroupEffectivePolicy?(groupId: string): Promise<Policy | null>;
    moveGroup?(groupId: string, newParentId: string | null): Promise<Group>;
    getGroupHierarchyStats?(): Promise<GroupHierarchyStats>;
    /**
     * Persist a new single-use enrollment challenge. The adapter
     * should store it with `consumed_at = null` and enforce a
     * primary-key constraint on `challenge` so duplicate inserts
     * fail loudly.
     */
    createEnrollmentChallenge?(challenge: EnrollmentChallenge): Promise<void>;
    /**
     * Look up a challenge by its opaque value. Returns `null` if not
     * found. Does NOT filter on expiry — the core layer checks
     * freshness so the adapter stays dumb.
     */
    findEnrollmentChallenge?(challenge: string): Promise<EnrollmentChallenge | null>;
    /**
     * Atomically mark a challenge as consumed. Must set
     * `consumed_at = now()` and return the updated row only when the
     * challenge was previously unused. Adapters should implement
     * this as a conditional UPDATE (e.g. Postgres
     * `UPDATE ... WHERE consumed_at IS NULL RETURNING *`) so two
     * concurrent consume attempts cannot both succeed.
     */
    consumeEnrollmentChallenge?(challenge: string): Promise<EnrollmentChallenge | null>;
    /**
     * Delete expired, unconsumed challenges. Called periodically by
     * the core layer; adapters can no-op if they rely on a TTL index
     * elsewhere.
     */
    pruneExpiredEnrollmentChallenges?(now: Date): Promise<number>;
    findTenant?(id: string): Promise<Tenant | null>;
    findTenantBySlug?(slug: string): Promise<Tenant | null>;
    listTenants?(filter?: TenantFilter): Promise<TenantListResult>;
    createTenant?(data: CreateTenantInput): Promise<Tenant>;
    updateTenant?(id: string, data: UpdateTenantInput): Promise<Tenant>;
    deleteTenant?(id: string): Promise<void>;
    getTenantStats?(tenantId: string): Promise<TenantStats>;
    findUser?(id: string): Promise<User | null>;
    findUserByEmail?(email: string, tenantId?: string): Promise<User | null>;
    listUsers?(filter?: UserFilter): Promise<UserListResult>;
    createUser?(data: CreateUserInput): Promise<User>;
    updateUser?(id: string, data: UpdateUserInput): Promise<User>;
    deleteUser?(id: string): Promise<void>;
    findRole?(id: string): Promise<Role | null>;
    listRoles?(tenantId?: string): Promise<Role[]>;
    createRole?(data: CreateRoleInput): Promise<Role>;
    updateRole?(id: string, data: UpdateRoleInput): Promise<Role>;
    deleteRole?(id: string): Promise<void>;
    assignRoleToUser?(userId: string, roleId: string): Promise<void>;
    removeRoleFromUser?(userId: string, roleId: string): Promise<void>;
    getUserRoles?(userId: string): Promise<Role[]>;
    createAuditLog?(data: CreateAuditLogInput): Promise<AuditLog>;
    listAuditLogs?(filter?: AuditLogFilter): Promise<AuditLogListResult>;
    deleteAuditLogs?(filter: {
        olderThan?: Date;
        tenantId?: string;
    }): Promise<number>;
    findScheduledTask?(id: string): Promise<ScheduledTask | null>;
    listScheduledTasks?(filter?: ScheduledTaskFilter): Promise<ScheduledTaskListResult>;
    createScheduledTask?(data: CreateScheduledTaskInput): Promise<ScheduledTask>;
    updateScheduledTask?(id: string, data: UpdateScheduledTaskInput): Promise<ScheduledTask>;
    deleteScheduledTask?(id: string): Promise<void>;
    getUpcomingTasks?(hours: number): Promise<ScheduledTask[]>;
    createTaskExecution?(data: {
        taskId: string;
    }): Promise<TaskExecution>;
    updateTaskExecution?(id: string, data: Partial<TaskExecution>): Promise<TaskExecution>;
    listTaskExecutions?(taskId: string, limit?: number): Promise<TaskExecution[]>;
    enqueueMessage?(data: EnqueueMessageInput): Promise<QueuedMessage>;
    dequeueMessages?(deviceId: string, limit?: number): Promise<QueuedMessage[]>;
    peekMessages?(deviceId: string, limit?: number): Promise<QueuedMessage[]>;
    acknowledgeMessage?(messageId: string): Promise<void>;
    failMessage?(messageId: string, error: string): Promise<void>;
    retryFailedMessages?(maxAttempts?: number): Promise<number>;
    purgeExpiredMessages?(): Promise<number>;
    getQueueStats?(tenantId?: string): Promise<QueueStats>;
    getPluginValue?(pluginName: string, key: string): Promise<unknown | null>;
    setPluginValue?(pluginName: string, key: string, value: unknown): Promise<void>;
    deletePluginValue?(pluginName: string, key: string): Promise<void>;
    listPluginKeys?(pluginName: string, prefix?: string): Promise<string[]>;
    clearPluginData?(pluginName: string): Promise<void>;
    getDashboardStats?(tenantId?: string): Promise<DashboardStats>;
    getDeviceStatusBreakdown?(tenantId?: string): Promise<DeviceStatusBreakdown>;
    getEnrollmentTrend?(days: number, tenantId?: string): Promise<EnrollmentTrendPoint[]>;
    getCommandSuccessRates?(tenantId?: string): Promise<CommandSuccessRates>;
    getAppInstallationSummary?(tenantId?: string): Promise<AppInstallationSummary>;
    transaction?<T>(fn: () => Promise<T>): Promise<T>;
}
interface PushAdapter {
    /** Send push message to a device */
    send(deviceId: string, message: PushMessage): Promise<PushResult>;
    /** Send push message to multiple devices */
    sendBatch(deviceIds: string[], message: PushMessage): Promise<PushBatchResult>;
    /** Register device push token */
    registerToken?(deviceId: string, token: string): Promise<void>;
    /** Unregister device push token */
    unregisterToken?(deviceId: string): Promise<void>;
    /** Subscribe device to topic */
    subscribe?(deviceId: string, topic: string): Promise<void>;
    /** Unsubscribe device from topic */
    unsubscribe?(deviceId: string, topic: string): Promise<void>;
}
interface PushMessage {
    type: string;
    payload?: Record<string, unknown>;
    priority?: 'high' | 'normal';
    ttl?: number;
    collapseKey?: string;
}
interface PushResult {
    success: boolean;
    messageId?: string;
    error?: string;
}
interface PushBatchResult {
    successCount: number;
    failureCount: number;
    results: Array<{
        deviceId: string;
        result: PushResult;
    }>;
}
interface MDMPlugin {
    /** Unique plugin name */
    name: string;
    /** Plugin version */
    version: string;
    /** Called when MDM is initialized */
    onInit?(mdm: MDMInstance): Promise<void>;
    /** Called when MDM is destroyed */
    onDestroy?(): Promise<void>;
    /** Additional routes to mount */
    routes?: PluginRoute[];
    /** Middleware to apply to all routes */
    middleware?: PluginMiddleware[];
    /** Extend enrollment process */
    onEnroll?(device: Device, request: EnrollmentRequest): Promise<void>;
    /** Extend device processing */
    onDeviceEnrolled?(device: Device): Promise<void>;
    onDeviceUnenrolled?(device: Device): Promise<void>;
    onHeartbeat?(device: Device, heartbeat: Heartbeat): Promise<void>;
    /** Extend policy processing */
    policySchema?: Record<string, unknown>;
    validatePolicy?(settings: PolicySettings): Promise<{
        valid: boolean;
        errors?: string[];
    }>;
    applyPolicy?(device: Device, policy: Policy): Promise<void>;
    /** Extend command processing */
    commandTypes?: CommandType[];
    executeCommand?(device: Device, command: Command): Promise<CommandResult>;
}
interface PluginRoute {
    method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
    path: string;
    handler: (context: unknown) => Promise<unknown>;
    auth?: boolean;
    admin?: boolean;
}
type PluginMiddleware = (context: unknown, next: () => Promise<unknown>) => Promise<unknown>;
interface WebhookManager {
    /** Deliver an event to all matching webhook endpoints */
    deliver<T>(event: MDMEvent<T>): Promise<WebhookDeliveryResult[]>;
    /** Add a webhook endpoint at runtime */
    addEndpoint(endpoint: WebhookEndpoint): void;
    /** Remove a webhook endpoint */
    removeEndpoint(endpointId: string): void;
    /** Update a webhook endpoint */
    updateEndpoint(endpointId: string, updates: Partial<WebhookEndpoint>): void;
    /** Get all configured endpoints */
    getEndpoints(): WebhookEndpoint[];
    /** Test a webhook endpoint with a test payload */
    testEndpoint(endpointId: string): Promise<WebhookDeliveryResult>;
}
interface WebhookDeliveryResult {
    endpointId: string;
    success: boolean;
    statusCode?: number;
    error?: string;
    retryCount: number;
    deliveredAt?: Date;
}
interface MDMInstance {
    /** Device management */
    devices: DeviceManager;
    /** Policy management */
    policies: PolicyManager;
    /** Application management */
    apps: ApplicationManager;
    /** Command management */
    commands: CommandManager;
    /** Group management */
    groups: GroupManager;
    /** Tenant management (if multi-tenancy enabled) */
    tenants?: TenantManager;
    /** Authorization management (RBAC) */
    authorization?: AuthorizationManager;
    /** Audit logging */
    audit?: AuditManager;
    /** Scheduled task management */
    schedules?: ScheduleManager;
    /** Persistent message queue */
    messageQueue?: MessageQueueManager;
    /** Dashboard analytics */
    dashboard?: DashboardManager;
    /** Plugin storage */
    pluginStorage?: PluginStorageAdapter;
    /** Push notification service */
    push: PushAdapter;
    /** Webhook delivery (if configured) */
    webhooks?: WebhookManager;
    /** Database adapter */
    db: DatabaseAdapter;
    /** Structured logger. Already scoped to the `openmdm` namespace. Plugins should call `.child({...})` to scope further. */
    logger: Logger;
    /** Configuration */
    config: MDMConfig;
    /** Subscribe to events */
    on<T extends EventType>(event: T, handler: EventHandler<T>): () => void;
    /** Emit an event */
    emit<T extends EventType>(event: T, data: EventPayloadMap[T]): Promise<void>;
    /** Process device enrollment */
    enroll(request: EnrollmentRequest): Promise<EnrollmentResponse>;
    /** Process device heartbeat */
    processHeartbeat(deviceId: string, heartbeat: Heartbeat): Promise<void>;
    /** Verify device token */
    verifyDeviceToken(token: string): Promise<{
        deviceId: string;
    } | null>;
    /** Get loaded plugins */
    getPlugins(): MDMPlugin[];
    /** Get plugin by name */
    getPlugin(name: string): MDMPlugin | undefined;
}
interface DeviceManager {
    get(id: string): Promise<Device | null>;
    getByEnrollmentId(enrollmentId: string): Promise<Device | null>;
    list(filter?: DeviceFilter): Promise<DeviceListResult>;
    create(data: CreateDeviceInput): Promise<Device>;
    update(id: string, data: UpdateDeviceInput): Promise<Device>;
    delete(id: string): Promise<void>;
    assignPolicy(deviceId: string, policyId: string | null): Promise<Device>;
    addToGroup(deviceId: string, groupId: string): Promise<void>;
    removeFromGroup(deviceId: string, groupId: string): Promise<void>;
    getGroups(deviceId: string): Promise<Group[]>;
    sendCommand(deviceId: string, input: Omit<SendCommandInput, 'deviceId'>): Promise<Command>;
    sync(deviceId: string): Promise<Command>;
    reboot(deviceId: string): Promise<Command>;
    lock(deviceId: string, message?: string): Promise<Command>;
    wipe(deviceId: string, preserveData?: boolean): Promise<Command>;
}
interface PolicyManager {
    get(id: string): Promise<Policy | null>;
    getDefault(): Promise<Policy | null>;
    list(): Promise<Policy[]>;
    create(data: CreatePolicyInput): Promise<Policy>;
    update(id: string, data: UpdatePolicyInput): Promise<Policy>;
    delete(id: string): Promise<void>;
    setDefault(id: string): Promise<Policy>;
    getDevices(policyId: string): Promise<Device[]>;
    applyToDevice(policyId: string, deviceId: string): Promise<void>;
}
interface ApplicationManager {
    get(id: string): Promise<Application | null>;
    getByPackage(packageName: string, version?: string): Promise<Application | null>;
    list(activeOnly?: boolean): Promise<Application[]>;
    register(data: CreateApplicationInput): Promise<Application>;
    update(id: string, data: UpdateApplicationInput): Promise<Application>;
    delete(id: string): Promise<void>;
    activate(id: string): Promise<Application>;
    deactivate(id: string): Promise<Application>;
    deploy(packageName: string, target: DeployTarget): Promise<void>;
    installOnDevice(packageName: string, deviceId: string, version?: string): Promise<Command>;
    uninstallFromDevice(packageName: string, deviceId: string): Promise<Command>;
}
interface CommandManager {
    get(id: string): Promise<Command | null>;
    list(filter?: CommandFilter): Promise<Command[]>;
    send(input: SendCommandInput): Promise<Command>;
    cancel(id: string): Promise<Command>;
    acknowledge(id: string): Promise<Command>;
    complete(id: string, result: CommandResult): Promise<Command>;
    fail(id: string, error: string): Promise<Command>;
    getPending(deviceId: string): Promise<Command[]>;
}
interface GroupManager {
    get(id: string): Promise<Group | null>;
    list(): Promise<Group[]>;
    create(data: CreateGroupInput): Promise<Group>;
    update(id: string, data: UpdateGroupInput): Promise<Group>;
    delete(id: string): Promise<void>;
    getDevices(groupId: string): Promise<Device[]>;
    addDevice(groupId: string, deviceId: string): Promise<void>;
    removeDevice(groupId: string, deviceId: string): Promise<void>;
    getChildren(groupId: string): Promise<Group[]>;
    getTree(rootId?: string): Promise<GroupTreeNode[]>;
    getAncestors(groupId: string): Promise<Group[]>;
    getDescendants(groupId: string): Promise<Group[]>;
    move(groupId: string, newParentId: string | null): Promise<Group>;
    getEffectivePolicy(groupId: string): Promise<Policy | null>;
    getHierarchyStats(): Promise<GroupHierarchyStats>;
}
interface GroupTreeNode extends Group {
    children: GroupTreeNode[];
    depth: number;
    path: string[];
    effectivePolicyId?: string | null;
}
interface GroupHierarchyStats {
    totalGroups: number;
    maxDepth: number;
    groupsWithDevices: number;
    groupsWithPolicies: number;
}
type TenantStatus = 'active' | 'suspended' | 'pending';
interface Tenant {
    id: string;
    name: string;
    slug: string;
    status: TenantStatus;
    settings?: TenantSettings | null;
    metadata?: Record<string, unknown> | null;
    createdAt: Date;
    updatedAt: Date;
}
interface TenantSettings {
    maxDevices?: number;
    maxUsers?: number;
    features?: string[];
    branding?: {
        logo?: string;
        primaryColor?: string;
    };
}
interface CreateTenantInput {
    name: string;
    slug: string;
    settings?: TenantSettings;
    metadata?: Record<string, unknown>;
}
interface UpdateTenantInput {
    name?: string;
    slug?: string;
    status?: TenantStatus;
    settings?: TenantSettings;
    metadata?: Record<string, unknown>;
}
interface TenantFilter {
    status?: TenantStatus;
    search?: string;
    limit?: number;
    offset?: number;
}
interface TenantListResult {
    tenants: Tenant[];
    total: number;
    limit: number;
    offset: number;
}
interface TenantStats {
    deviceCount: number;
    userCount: number;
    policyCount: number;
    appCount: number;
}
type PermissionAction = 'create' | 'read' | 'update' | 'delete' | 'manage' | '*';
type PermissionResource = 'devices' | 'policies' | 'apps' | 'groups' | 'commands' | 'users' | 'roles' | 'tenants' | 'audit' | '*';
interface Permission {
    action: PermissionAction;
    resource: PermissionResource;
    resourceId?: string;
}
interface Role {
    id: string;
    tenantId?: string | null;
    name: string;
    description?: string | null;
    permissions: Permission[];
    isSystem: boolean;
    createdAt: Date;
    updatedAt: Date;
}
interface CreateRoleInput {
    tenantId?: string;
    name: string;
    description?: string;
    permissions: Permission[];
}
interface UpdateRoleInput {
    name?: string;
    description?: string;
    permissions?: Permission[];
}
interface User {
    id: string;
    tenantId?: string | null;
    email: string;
    name?: string | null;
    status: 'active' | 'inactive' | 'pending';
    metadata?: Record<string, unknown> | null;
    lastLoginAt?: Date | null;
    createdAt: Date;
    updatedAt: Date;
}
interface UserWithRoles extends User {
    roles: Role[];
}
interface CreateUserInput {
    tenantId?: string;
    email: string;
    name?: string;
    status?: 'active' | 'inactive' | 'pending';
    metadata?: Record<string, unknown>;
}
interface UpdateUserInput {
    email?: string;
    name?: string;
    status?: 'active' | 'inactive' | 'pending';
    metadata?: Record<string, unknown>;
}
interface UserFilter {
    tenantId?: string;
    status?: 'active' | 'inactive' | 'pending';
    search?: string;
    limit?: number;
    offset?: number;
}
interface UserListResult {
    users: User[];
    total: number;
    limit: number;
    offset: number;
}
type AuditAction = 'create' | 'read' | 'update' | 'delete' | 'login' | 'logout' | 'enroll' | 'unenroll' | 'command' | 'export' | 'import' | 'custom';
interface AuditLog {
    id: string;
    tenantId?: string | null;
    userId?: string | null;
    action: AuditAction;
    resource: string;
    resourceId?: string | null;
    status: 'success' | 'failure';
    error?: string | null;
    details?: Record<string, unknown> | null;
    ipAddress?: string | null;
    userAgent?: string | null;
    createdAt: Date;
}
interface CreateAuditLogInput {
    tenantId?: string;
    userId?: string;
    action: AuditAction;
    resource: string;
    resourceId?: string;
    status?: 'success' | 'failure';
    error?: string;
    details?: Record<string, unknown>;
    ipAddress?: string;
    userAgent?: string;
}
interface AuditConfig {
    enabled: boolean;
    retentionDays?: number;
    skipReadOperations?: boolean;
    logActions?: AuditAction[];
    logResources?: string[];
}
interface AuditSummary {
    totalLogs: number;
    byAction: Record<AuditAction, number>;
    byResource: Record<string, number>;
    byStatus: {
        success: number;
        failure: number;
    };
    topUsers: Array<{
        userId: string;
        count: number;
    }>;
    recentFailures: AuditLog[];
}
interface AuditLogFilter {
    tenantId?: string;
    userId?: string;
    action?: string;
    resource?: string;
    resourceId?: string;
    startDate?: Date;
    endDate?: Date;
    limit?: number;
    offset?: number;
}
interface AuditLogListResult {
    logs: AuditLog[];
    total: number;
    limit: number;
    offset: number;
}
type TaskType = 'command' | 'policy_update' | 'app_install' | 'maintenance' | 'custom';
type ScheduledTaskStatus = 'active' | 'paused' | 'completed' | 'failed';
interface MaintenanceWindow {
    daysOfWeek: number[];
    startTime: string;
    endTime: string;
    timezone: string;
}
interface TaskSchedule {
    type: 'once' | 'recurring' | 'window';
    executeAt?: Date;
    cron?: string;
    window?: MaintenanceWindow;
}
interface ScheduledTask {
    id: string;
    tenantId?: string | null;
    name: string;
    description?: string | null;
    taskType: TaskType;
    schedule: TaskSchedule;
    target?: DeployTarget;
    payload?: Record<string, unknown> | null;
    status: ScheduledTaskStatus;
    nextRunAt?: Date | null;
    lastRunAt?: Date | null;
    maxRetries: number;
    retryCount: number;
    createdAt: Date;
    updatedAt: Date;
}
interface CreateScheduledTaskInput {
    tenantId?: string;
    name: string;
    description?: string;
    taskType: TaskType;
    schedule: TaskSchedule;
    target?: DeployTarget;
    payload?: Record<string, unknown>;
    maxRetries?: number;
}
interface UpdateScheduledTaskInput {
    name?: string;
    description?: string;
    schedule?: TaskSchedule;
    target?: DeployTarget;
    payload?: Record<string, unknown>;
    status?: ScheduledTaskStatus;
    maxRetries?: number;
}
interface ScheduledTaskFilter {
    tenantId?: string;
    taskType?: TaskType | TaskType[];
    status?: ScheduledTaskStatus | ScheduledTaskStatus[];
    limit?: number;
    offset?: number;
}
interface ScheduledTaskListResult {
    tasks: ScheduledTask[];
    total: number;
    limit: number;
    offset: number;
}
interface TaskExecution {
    id: string;
    taskId: string;
    status: 'running' | 'completed' | 'failed';
    startedAt: Date;
    completedAt?: Date | null;
    devicesProcessed: number;
    devicesSucceeded: number;
    devicesFailed: number;
    error?: string | null;
    details?: Record<string, unknown> | null;
}
type QueueMessageStatus = 'pending' | 'processing' | 'delivered' | 'failed' | 'expired';
interface QueuedMessage {
    id: string;
    tenantId?: string | null;
    deviceId: string;
    messageType: string;
    payload: Record<string, unknown>;
    priority: 'high' | 'normal' | 'low';
    status: QueueMessageStatus;
    attempts: number;
    maxAttempts: number;
    lastAttemptAt?: Date | null;
    lastError?: string | null;
    expiresAt?: Date | null;
    createdAt: Date;
    updatedAt: Date;
}
interface EnqueueMessageInput {
    tenantId?: string;
    deviceId: string;
    messageType: string;
    payload: Record<string, unknown>;
    priority?: 'high' | 'normal' | 'low';
    maxAttempts?: number;
    ttlSeconds?: number;
}
interface QueueStats {
    pending: number;
    processing: number;
    delivered: number;
    failed: number;
    expired: number;
    byDevice: Record<string, number>;
    oldestPending?: Date;
}
interface DashboardStats {
    devices: {
        total: number;
        enrolled: number;
        active: number;
        blocked: number;
        pending: number;
    };
    policies: {
        total: number;
        deployed: number;
    };
    applications: {
        total: number;
        deployed: number;
    };
    commands: {
        pendingCount: number;
        last24hTotal: number;
        last24hSuccess: number;
        last24hFailed: number;
    };
    groups: {
        total: number;
        withDevices: number;
    };
}
interface DeviceStatusBreakdown {
    byStatus: Record<DeviceStatus, number>;
    byOs: Record<string, number>;
    byManufacturer: Record<string, number>;
    byModel: Record<string, number>;
}
interface EnrollmentTrendPoint {
    date: Date;
    enrolled: number;
    unenrolled: number;
    netChange: number;
    totalDevices: number;
}
interface CommandSuccessRates {
    overall: {
        total: number;
        completed: number;
        failed: number;
        successRate: number;
    };
    byType: Record<string, {
        total: number;
        completed: number;
        failed: number;
        successRate: number;
        avgExecutionTimeMs?: number;
    }>;
    last24h: {
        total: number;
        completed: number;
        failed: number;
        pending: number;
    };
}
interface AppInstallationSummary {
    total: number;
    byStatus: Record<string, number>;
    recentFailures: Array<{
        packageName: string;
        deviceId: string;
        error: string;
        timestamp: Date;
    }>;
    topInstalled: Array<{
        packageName: string;
        name: string;
        installedCount: number;
    }>;
}
interface PluginStorageAdapter {
    get<T>(pluginName: string, key: string): Promise<T | null>;
    set<T>(pluginName: string, key: string, value: T): Promise<void>;
    delete(pluginName: string, key: string): Promise<void>;
    list(pluginName: string, prefix?: string): Promise<string[]>;
    clear(pluginName: string): Promise<void>;
}
interface PluginStorageEntry {
    pluginName: string;
    key: string;
    value: unknown;
    createdAt: Date;
    updatedAt: Date;
}
interface TenantManager {
    get(id: string): Promise<Tenant | null>;
    getBySlug(slug: string): Promise<Tenant | null>;
    list(filter?: TenantFilter): Promise<TenantListResult>;
    create(data: CreateTenantInput): Promise<Tenant>;
    update(id: string, data: UpdateTenantInput): Promise<Tenant>;
    delete(id: string, cascade?: boolean): Promise<void>;
    getStats(tenantId: string): Promise<TenantStats>;
    activate(id: string): Promise<Tenant>;
    deactivate(id: string): Promise<Tenant>;
}
interface AuthorizationManager {
    createRole(data: CreateRoleInput): Promise<Role>;
    getRole(id: string): Promise<Role | null>;
    listRoles(tenantId?: string): Promise<Role[]>;
    updateRole(id: string, data: UpdateRoleInput): Promise<Role>;
    deleteRole(id: string): Promise<void>;
    createUser(data: CreateUserInput): Promise<User>;
    getUser(id: string): Promise<UserWithRoles | null>;
    getUserByEmail(email: string, tenantId?: string): Promise<UserWithRoles | null>;
    listUsers(filter?: UserFilter): Promise<UserListResult>;
    updateUser(id: string, data: UpdateUserInput): Promise<User>;
    deleteUser(id: string): Promise<void>;
    assignRole(userId: string, roleId: string): Promise<void>;
    removeRole(userId: string, roleId: string): Promise<void>;
    getUserRoles(userId: string): Promise<Role[]>;
    can(userId: string, action: PermissionAction, resource: PermissionResource, resourceId?: string): Promise<boolean>;
    canAny(userId: string, permissions: Array<{
        action: PermissionAction;
        resource: PermissionResource;
    }>): Promise<boolean>;
    requirePermission(userId: string, action: PermissionAction, resource: PermissionResource, resourceId?: string): Promise<void>;
    isAdmin(userId: string): Promise<boolean>;
}
interface AuditManager {
    log(entry: CreateAuditLogInput): Promise<AuditLog>;
    list(filter?: AuditLogFilter): Promise<AuditLogListResult>;
    getByResource(resource: string, resourceId: string): Promise<AuditLog[]>;
    getByUser(userId: string, filter?: AuditLogFilter): Promise<AuditLogListResult>;
    export(filter: AuditLogFilter, format: 'json' | 'csv'): Promise<string>;
    purge(olderThanDays?: number): Promise<number>;
    getSummary(tenantId?: string, days?: number): Promise<AuditSummary>;
}
interface ScheduleManager {
    get(id: string): Promise<ScheduledTask | null>;
    list(filter?: ScheduledTaskFilter): Promise<ScheduledTaskListResult>;
    create(data: CreateScheduledTaskInput): Promise<ScheduledTask>;
    update(id: string, data: UpdateScheduledTaskInput): Promise<ScheduledTask>;
    delete(id: string): Promise<void>;
    pause(id: string): Promise<ScheduledTask>;
    resume(id: string): Promise<ScheduledTask>;
    runNow(id: string): Promise<TaskExecution>;
    getUpcoming(hours: number): Promise<ScheduledTask[]>;
    getExecutions(taskId: string, limit?: number): Promise<TaskExecution[]>;
    calculateNextRun(schedule: TaskSchedule): Date | null;
}
interface MessageQueueManager {
    enqueue(message: EnqueueMessageInput): Promise<QueuedMessage>;
    enqueueBatch(messages: EnqueueMessageInput[]): Promise<QueuedMessage[]>;
    dequeue(deviceId: string, limit?: number): Promise<QueuedMessage[]>;
    acknowledge(messageId: string): Promise<void>;
    fail(messageId: string, error: string): Promise<void>;
    retryFailed(maxAttempts?: number): Promise<number>;
    purgeExpired(): Promise<number>;
    getStats(tenantId?: string): Promise<QueueStats>;
    peek(deviceId: string, limit?: number): Promise<QueuedMessage[]>;
}
interface DashboardManager {
    getStats(tenantId?: string): Promise<DashboardStats>;
    getDeviceStatusBreakdown(tenantId?: string): Promise<DeviceStatusBreakdown>;
    getEnrollmentTrend(days: number, tenantId?: string): Promise<EnrollmentTrendPoint[]>;
    getCommandSuccessRates(tenantId?: string): Promise<CommandSuccessRates>;
    getAppInstallationSummary(tenantId?: string): Promise<AppInstallationSummary>;
}
type EventHandler<T extends EventType> = (event: MDMEvent<EventPayloadMap[T]>) => Promise<void> | void;
interface EventPayloadMap {
    'device.enrolled': {
        device: Device;
    };
    'device.unenrolled': {
        device: Device;
        reason?: string;
    };
    'device.blocked': {
        device: Device;
        reason: string;
    };
    'device.heartbeat': {
        device: Device;
        heartbeat: Heartbeat;
    };
    'device.locationUpdated': {
        device: Device;
        location: DeviceLocation;
    };
    'device.statusChanged': {
        device: Device;
        oldStatus: DeviceStatus;
        newStatus: DeviceStatus;
    };
    'device.policyChanged': {
        device: Device;
        oldPolicyId?: string;
        newPolicyId?: string;
    };
    'app.installed': {
        device: Device;
        app: InstalledApp;
    };
    'app.uninstalled': {
        device: Device;
        packageName: string;
    };
    'app.updated': {
        device: Device;
        app: InstalledApp;
        oldVersion: string;
    };
    'app.crashed': {
        device: Device;
        packageName: string;
        error?: string;
    };
    'app.started': {
        device: Device;
        packageName: string;
    };
    'app.stopped': {
        device: Device;
        packageName: string;
    };
    'policy.applied': {
        device: Device;
        policy: Policy;
    };
    'policy.failed': {
        device: Device;
        policy: Policy;
        error: string;
    };
    'command.received': {
        device: Device;
        command: Command;
    };
    'command.acknowledged': {
        device: Device;
        command: Command;
    };
    'command.completed': {
        device: Device;
        command: Command;
        result: CommandResult;
    };
    'command.failed': {
        device: Device;
        command: Command;
        error: string;
    };
    'security.tamper': {
        device: Device;
        type: string;
        details?: unknown;
    };
    'security.rootDetected': {
        device: Device;
    };
    'security.screenLocked': {
        device: Device;
    };
    'security.screenUnlocked': {
        device: Device;
    };
    custom: Record<string, unknown>;
}
declare class MDMError extends Error {
    code: string;
    statusCode: number;
    details?: unknown | undefined;
    constructor(message: string, code: string, statusCode?: number, details?: unknown | undefined);
}
declare class DeviceNotFoundError extends MDMError {
    constructor(deviceId: string);
}
declare class PolicyNotFoundError extends MDMError {
    constructor(policyId: string);
}
declare class ApplicationNotFoundError extends MDMError {
    constructor(identifier: string);
}
declare class CommandNotFoundError extends MDMError {
    constructor(commandId: string);
}
declare class TenantNotFoundError extends MDMError {
    constructor(identifier: string);
}
declare class RoleNotFoundError extends MDMError {
    constructor(identifier: string);
}
declare class GroupNotFoundError extends MDMError {
    constructor(identifier: string);
}
declare class UserNotFoundError extends MDMError {
    constructor(identifier: string);
}
declare class EnrollmentError extends MDMError {
    constructor(message: string, details?: unknown);
}
declare class AuthenticationError extends MDMError {
    constructor(message?: string);
}
declare class AuthorizationError extends MDMError {
    constructor(message?: string);
}
declare class ValidationError extends MDMError {
    constructor(message: string, details?: unknown);
}

export { type AppInstallationSummary, type AppRollback, type AppVersion, type Application, type ApplicationManager, ApplicationNotFoundError, type AuditAction, type AuditConfig, type AuditLog, type AuditLogFilter, type AuditLogListResult, type AuditManager, type AuditSummary, type AuthConfig, AuthenticationError, AuthorizationError, type AuthorizationManager, type Command, type CommandFilter, type CommandManager, CommandNotFoundError, type CommandResult, type CommandStatus, type CommandSuccessRates, type CommandType, type CreateAppRollbackInput, type CreateApplicationInput, type CreateAuditLogInput, type CreateDeviceInput, type CreateGroupInput, type CreatePolicyInput, type CreateRoleInput, type CreateScheduledTaskInput, type CreateTenantInput, type CreateUserInput, type DashboardManager, type DashboardStats, type DatabaseAdapter, type DeployTarget, type Device, type DeviceFilter, type DeviceIdentityVerification, type DeviceListResult, type DeviceLocation, type DeviceManager, DeviceNotFoundError, type DeviceStatus, type DeviceStatusBreakdown, type EnqueueMessageInput, type EnrollmentChallenge, type EnrollmentConfig, EnrollmentError, type EnrollmentMethod, type EnrollmentRequest, type EnrollmentResponse, type EnrollmentTrendPoint, type EventFilter, type EventHandler, type EventPayloadMap, type EventType, type Group, type GroupHierarchyStats, type GroupManager, GroupNotFoundError, type GroupTreeNode, type HardwareControl, type Heartbeat, type InstalledApp, type LogContext, type Logger, type MDMConfig, MDMError, type MDMEvent, type MDMInstance, type MDMPlugin, type MaintenanceWindow, type MessageQueueManager, type PasswordPolicy, type Permission, type PermissionAction, type PermissionResource, type PinnedKeyConfig, type PluginMiddleware, type PluginRoute, type PluginStorageAdapter, type PluginStorageEntry, type Policy, type PolicyApplication, type PolicyManager, PolicyNotFoundError, type PolicySettings, type PushAdapter, type PushBatchResult, type PushConfig, type PushMessage, type PushProviderConfig, type PushResult, type PushToken, type QueueMessageStatus, type QueueStats, type QueuedMessage, type RegisterPushTokenInput, type Role, RoleNotFoundError, type ScheduleManager, type ScheduledTask, type ScheduledTaskFilter, type ScheduledTaskListResult, type ScheduledTaskStatus, type SendCommandInput, type StorageConfig, type SystemUpdatePolicy, type TaskExecution, type TaskSchedule, type TaskType, type Tenant, type TenantFilter, type TenantListResult, type TenantManager, TenantNotFoundError, type TenantSettings, type TenantStats, type TenantStatus, type TimeWindow, type UpdateApplicationInput, type UpdateDeviceInput, type UpdateGroupInput, type UpdatePolicyInput, type UpdateRoleInput, type UpdateScheduledTaskInput, type UpdateTenantInput, type UpdateUserInput, type User, type UserFilter, type UserListResult, UserNotFoundError, type UserWithRoles, ValidationError, type VpnConfig, type WebhookConfig, type WebhookDeliveryResult, type WebhookEndpoint, type WebhookManager, type WifiConfig };