import * as plugins from '../../plugins.js';
import type { OpsServer } from '../classes.opsserver.js';
import * as interfaces from '../../../dist_ts_interfaces/index.js';
export interface IJwtData {
    userId: string;
    status: 'loggedIn' | 'loggedOut';
    expiresAt: number;
}
export declare class AdminHandler {
    private opsServerRef;
    typedrouter: plugins.typedrequest.TypedRouter<interfaces.typedrequestInterfaces.ITypedRequest>;
    smartjwtInstance: plugins.smartjwt.SmartJwt<IJwtData>;
    private users;
    private accountStore?;
    private idpClient?;
    private ownsIdpClient;
    constructor(opsServerRef: OpsServer);
    initialize(): Promise<void>;
    stop(): Promise<void>;
    private initializeJwt;
    private jwtAdoptionTimer?;
    private scheduleJwtKeypairAdoption;
    private adoptPersistedJwtKeypair;
    private initializeDefaultUsers;
    /**
     * Return a safe projection of the active user source — excludes password fields.
     * Used by UsersHandler to serve the admin-only listUsers endpoint.
     */
    listUsers(): Promise<interfaces.requests.IAdminUserProjection[]>;
    getBootstrapStatus(): Promise<interfaces.requests.IReq_GetAdminBootstrapStatus['response']>;
    createInitialAdminUser(optionsArg: {
        email: string;
        name?: string;
        password: string;
        enableIdpGlobalAuth?: boolean;
    }): Promise<interfaces.requests.IReq_CreateInitialAdminUser['response']>;
    createUser(optionsArg: {
        email: string;
        name?: string;
        role: interfaces.requests.TUserManagementRole;
        password: string;
        enableIdpGlobalAuth?: boolean;
    }): Promise<interfaces.requests.IReq_CreateUser['response']>;
    deleteUser(optionsArg: {
        id: string;
        requestingUserId: string;
    }): Promise<interfaces.requests.IReq_DeleteUser['response']>;
    private registerHandlers;
    /**
     * Create a guard for valid identity (matching cloudly pattern)
     */
    validIdentityGuard: plugins.smartguard.Guard<{
        identity: interfaces.data.IIdentity;
    }>;
    /**
     * Create a guard for admin identity (matching cloudly pattern)
     */
    adminIdentityGuard: plugins.smartguard.Guard<{
        identity: interfaces.data.IIdentity;
    }>;
    validateIdentity(identityArg?: interfaces.data.IIdentity): Promise<interfaces.data.IIdentity | null>;
    getVerifiedAdminIdentityFromJwt(jwtArg: string): Promise<interfaces.data.IIdentity>;
    private authenticateUser;
    private recordAuthenticationAttempt;
    private resolveUser;
    private getPersistentAccountState;
    private isPersistenceEnabled;
    private getAccountStore;
    private getIdpClient;
    private isIdpGlobalConfigured;
    private accountToUser;
    private createIdentityForUser;
}