/**
 * Seed the local Ory environment with test data for development.
 *
 * Creates the **User** (`user@ory-local.dev`) — a human identity with a
 * known password (printed by the launcher) and an OAuth2
 * `authorization_code` + PKCE client registered against the loopback
 * redirect URIs. The launcher always runs the real PKCE browser flow; the
 * user types these credentials into the login UI to complete the flow.
 *
 * No agent principal is seeded: the harness self-registers a DCR OAuth2
 * client for the agent on first session start (using the user's bearer as
 * the initial access token), and permission checks are made against the
 * user subject — so a pre-seeded agent Kratos identity would be unused.
 *
 * Permission tuples are written as SubjectSet `User:<identity.id>` so
 * the Console's *Add relationship* dialog (which always emits SubjectSet
 * subjects) can recreate them by hand for the demo walkthrough. Plugins
 * build the matching SubjectSet check when `ORY_USER_SUBJECT_NAMESPACE`
 * is set (the launcher sets it to `User`).
 *
 * Idempotent — re-running the seed reuses existing identities and
 * recreates OAuth2 clients (so the secret is always known).
 */
/**
 * The client id Hydra issues to the seeded user PKCE client: the same
 * **reserved** id Ory Network's Agent Security setup uses, so local dev and a
 * hosted project name the shared login client identically and the id — never a
 * `client_name` — is what resolves it in both.
 *
 * Stable, so `local configure` can persist it to the shared config and
 * downstream runs can rely on `ORY_OAUTH2_CLIENT_ID` resolution without first
 * dragging the value out of the `local up` banner.
 */
export declare const USER_CLIENT_ID = "ory-agent-security-login";
export interface SeededIdentity {
    id: string;
    email: string;
}
export interface SeededOAuth2Client {
    clientId: string;
    clientSecret?: string;
}
export interface SeedResult {
    /** User (human) identity — subject of permission checks. */
    user: {
        identity: SeededIdentity;
        /**
         * Password for the user identity. Printed by the launcher so the
         * developer can type it into the login UI during the PKCE browser
         * flow. Local-dev only — never used in production.
         */
        password: string;
        /** OAuth2 authorization_code+PKCE client for interactive logins. */
        client: SeededOAuth2Client;
    };
    /** Native baseline permission tuples written against the user's subject (always zero). */
    permissions: {
        namespace: string;
        subject: string;
        tuples: number;
    };
}
/**
 * Subject namespace for user identities in seeded permission tuples. Re-exported
 * from the core default so the seed, the runtime resolver, and the persisted
 * install config all address the user under the same namespace.
 */
export declare const USER_SUBJECT_NAMESPACE = "User";
/**
 * Run the full seed process. Idempotent — safe to run multiple times.
 *
 * Returns a `SeedResult` describing both identities, the user's
 * pre-minted session, and the OAuth2 clients registered for each.
 */
export declare function seedLocalEnvironment(namespace?: string): Promise<SeedResult>;