/**
 * Business Manager user operations for B2C Commerce instances.
 *
 * Provides functions for querying and managing instance-level users via OCAPI Data API.
 *
 * Note: Most production B2C Commerce instances delegate user identity to Account Manager
 * (SSO), so creating local Business Manager users via the Data API typically fails with
 * `LocalUserCreationException`. These operations focus on read/search/lifecycle of
 * AM-managed users plus access-key administration.
 */
import type { B2CInstance } from '../../instance/index.js';
import type { components } from '../../clients/ocapi.generated.js';
/**
 * BM user from OCAPI.
 */
export type BmUser = components['schemas']['user'];
/**
 * BM users collection from OCAPI.
 */
export type BmUsers = components['schemas']['users'];
/**
 * BM user search result from OCAPI.
 */
export type BmUserSearchResult = components['schemas']['user_search_result'];
/**
 * Access key details for an externally-managed user.
 */
export type BmAccessKeyDetails = components['schemas']['access_key_details'];
/**
 * Valid access-key scopes accepted by the Data API
 * `/users/{login}/access_key/{scope}` endpoints.
 */
export declare const ACCESS_KEY_SCOPES: readonly ["WEBDAV_AND_STUDIO", "AGENT_USER_AND_OCAPI", "STOREFRONT"];
/**
 * Access-key scope. One of {@link ACCESS_KEY_SCOPES}.
 */
export type AccessKeyScope = (typeof ACCESS_KEY_SCOPES)[number];
/**
 * Updatable user fields for `patch` operations.
 *
 * Note: `locked` and `password` cannot be modified via PATCH per the API spec.
 */
export interface UpdateBmUserChanges {
    disabled?: boolean;
    email?: string;
    external_id?: string;
    first_name?: string;
    last_name?: string;
    preferred_data_locale?: string;
    preferred_ui_locale?: string;
}
/**
 * Options for listing BM users.
 */
export interface ListBmUsersOptions {
    /** Start index (default 0) */
    start?: number;
    /** Number of items to return (default 25) */
    count?: number;
    /** Property selector (default returns shallow user fields) */
    select?: string;
}
/**
 * Options for searching BM users.
 *
 * Searchable fields per the Data API spec: login, email, first_name, last_name,
 * external_id, last_login_date, is_locked, is_disabled.
 */
export interface SearchBmUsersOptions {
    /**
     * Pre-built OCAPI query object (e.g. `{text_query: {fields: ['login'], search_phrase: 'foo'}}`).
     * If omitted, one is built from the convenience flags below.
     */
    query?: unknown;
    /** Free-text phrase searched across login/email/first_name/last_name */
    searchPhrase?: string;
    /** Match users with a specific login */
    login?: string;
    /** Match users with a specific email */
    email?: string;
    /** Match locked users */
    locked?: boolean;
    /** Match disabled users */
    disabled?: boolean;
    /** Field to sort by (e.g. 'login', 'email', 'last_login_date') */
    sortBy?: string;
    /** Sort direction */
    sortOrder?: 'asc' | 'desc';
    /** Start index (default 0) */
    start?: number;
    /** Number of items to return (default 25) */
    count?: number;
    /** Property selector (default returns shallow user fields) */
    select?: string;
}
/**
 * Lists all users on a B2C Commerce instance.
 *
 * @param instance - B2C instance to query
 * @param options - Pagination options
 * @returns Users collection with pagination info
 */
export declare function listBmUsers(instance: B2CInstance, options?: ListBmUsersOptions): Promise<BmUsers>;
/**
 * Gets a single user by login (email).
 *
 * @param instance - B2C instance
 * @param login - User login
 * @returns User details
 */
export declare function getBmUser(instance: B2CInstance, login: string): Promise<BmUser>;
/**
 * Returns details for the currently authenticated user (the user the OAuth token resolves to).
 *
 * Useful for verifying which BM identity is in use on an instance.
 *
 * @param instance - B2C instance
 * @returns Current user details (includes password expiration info)
 */
export declare function whoamiBmUser(instance: B2CInstance): Promise<BmUser>;
/**
 * Updates an existing user. The `locked` flag and the user `password` cannot be updated
 * with this resource.
 *
 * @param instance - B2C instance
 * @param login - User login
 * @param changes - Fields to update
 * @returns Updated user
 */
export declare function updateBmUser(instance: B2CInstance, login: string, changes: UpdateBmUserChanges): Promise<BmUser>;
/**
 * Deletes a user from an instance.
 *
 * @param instance - B2C instance
 * @param login - User login
 */
export declare function deleteBmUser(instance: B2CInstance, login: string): Promise<void>;
/**
 * Searches users on an instance.
 *
 * Supports either a fully-formed OCAPI query (`options.query`) or convenience flags
 * (`searchPhrase`, `login`, `email`, `locked`, `disabled`) which are combined into a
 * `bool_query`. If no criteria are provided a `match_all_query` is used.
 *
 * @param instance - B2C instance
 * @param options - Search options
 * @returns User search result
 */
export declare function searchBmUsers(instance: B2CInstance, options?: SearchBmUsersOptions): Promise<BmUserSearchResult>;
/**
 * Gets a single access key for an externally-managed user.
 *
 * @param instance - B2C instance
 * @param login - User login
 * @param scope - Access key scope (one of {@link ACCESS_KEY_SCOPES})
 * @returns Access key details
 */
export declare function getBmUserAccessKey(instance: B2CInstance, login: string, scope: string): Promise<BmAccessKeyDetails>;
/**
 * Creates a single access key for an externally-managed user (replaces any existing key
 * for the same scope).
 *
 * The returned object includes the newly-generated `access_key` value — this is the only
 * time it is returned, so callers should record it.
 *
 * @param instance - B2C instance
 * @param login - User login
 * @param scope - Access key scope
 * @returns Access key details (including the secret `access_key` value)
 */
export declare function createBmUserAccessKey(instance: B2CInstance, login: string, scope: string): Promise<BmAccessKeyDetails>;
/**
 * Enables or disables an existing access key for an externally-managed user.
 *
 * @param instance - B2C instance
 * @param login - User login
 * @param scope - Access key scope
 * @param enabled - Whether the access key should be enabled
 * @returns Updated access key details
 */
export declare function setBmUserAccessKeyEnabled(instance: B2CInstance, login: string, scope: string, enabled: boolean): Promise<BmAccessKeyDetails>;
/**
 * Deletes a single access key for an externally-managed user.
 *
 * @param instance - B2C instance
 * @param login - User login
 * @param scope - Access key scope
 */
export declare function deleteBmUserAccessKey(instance: B2CInstance, login: string, scope: string): Promise<void>;