import * as s from '../schemas';
import type { Transport } from './transport';
/** Body for creating or editing an API key (POST/PUT `/api/auth/api-keys`). */
export interface ApiKeyBody {
    readonly user_id: string;
    readonly description: string;
    readonly scopes: string[];
    readonly owner_user_id?: string;
    readonly policy_data?: Record<string, unknown> | null;
    readonly condition?: s.TemplatedText | null;
}
/**
 * Body for one-time claim-link creation (POST `/api/auth/claim-links`). The
 * `api_key` is a raw key the caller holds (the just-minted key, client-side
 * exactly once); `ttl_seconds` optionally overrides the default lifetime (the
 * server caps it at its ceiling).
 */
export interface ClaimLinkBody {
    readonly api_key: string;
    readonly ttl_seconds?: number | null;
}
/** Body for adding a URL to a scope (POST `/api/auth/scopes`). */
export interface AddUrlToScopeBody {
    readonly scope_id: string;
    readonly url: string;
    readonly pattern?: string;
}
/**
 * Body for creating a role (POST `/api/auth/roles`). `base_tier` is the security
 * tier the role inherits (`editor`/`viewer` — `admin` is reserved); its jq is
 * resolved server-side, never authored here. `grants` is the editable per-tag
 * access-level map (feature-group tag → `none`/`read`/`write`); it defaults to
 * empty (every group `none`, fail-closed) when omitted.
 */
export interface RoleCreateBody {
    readonly name: string;
    readonly description?: string;
    readonly base_tier: string;
    readonly grants?: Record<string, s.GrantLevel>;
}
/**
 * Body for editing a role (PUT `/api/auth/roles/{name}`). Both fields are
 * omit-means-KEEP: an absent `grants` preserves the stored map (never a silent
 * wipe), an absent `description` preserves the stored description. The base-tier jq
 * is seed-fixed and not editable here.
 */
export interface RoleUpdateBody {
    readonly grants?: Record<string, s.GrantLevel>;
    readonly description?: string;
}
/**
 * Body for pinning a route public (POST `/api/auth/public-routes`). `pattern` is an
 * optional regex the AC verifier full-matches request paths against, mapping every
 * match to the `url` key (so a mount's whole subtree can be pinned in one call).
 */
export interface PinRoutePublicBody {
    readonly url: string;
    readonly pattern?: string;
}
export declare function authClient(t: Transport): {
    listScopes: (signal?: AbortSignal) => Promise<Record<string, string>>;
    addUrlToScope: (body: AddUrlToScopeBody) => Promise<{
        scope_id: string;
        url: string;
    }>;
    removeUrlFromScope: (body: {
        url: string;
    }) => Promise<{
        url: string;
    }>;
    removeScope: (scopeId: string) => Promise<{
        scope_id: string;
        deleted_keys: number;
    }>;
    listAuthRoutes: (signal?: AbortSignal) => Promise<{
        path: string;
        methods: string[];
        mapped: string | null;
        tags: string[];
        summary: string;
        action: "read" | "write" | "fenced" | "secret" | null;
    }[]>;
    listPublicRoutes: (signal?: AbortSignal) => Promise<string[]>;
    pinRoutePublic: (body: PinRoutePublicBody) => Promise<{
        url: string;
    }>;
    unpinPublicRoute: (url: string) => Promise<{
        url: string;
    }>;
    listRoles: (signal?: AbortSignal) => Promise<{
        allow_all: boolean;
        base_tier: string | null;
        condition: {
            content?: string | undefined;
            id?: string | undefined;
            kwargs?: Record<string, unknown> | undefined;
        } | null;
        description: string;
        grants: Record<string, "none" | "read" | "write">;
        name: string;
        scopes: string[];
    }[]>;
    createRole: (body: RoleCreateBody) => Promise<{
        allow_all: boolean;
        base_tier: string | null;
        condition: {
            content?: string | undefined;
            id?: string | undefined;
            kwargs?: Record<string, unknown> | undefined;
        } | null;
        description: string;
        grants: Record<string, "none" | "read" | "write">;
        name: string;
        scopes: string[];
    }>;
    updateRole: (name: string, body: RoleUpdateBody) => Promise<{
        allow_all: boolean;
        base_tier: string | null;
        condition: {
            content?: string | undefined;
            id?: string | undefined;
            kwargs?: Record<string, unknown> | undefined;
        } | null;
        description: string;
        grants: Record<string, "none" | "read" | "write">;
        name: string;
        scopes: string[];
    }>;
    deleteRole: (name: string) => Promise<{
        name: string;
        deleted: boolean;
    }>;
    listRoleVersions: (name: string, signal?: AbortSignal) => Promise<{
        versions: {
            version: number;
            body: {
                allow_all: boolean;
                base_tier: string | null;
                condition: {
                    content?: string | undefined;
                    id?: string | undefined;
                    kwargs?: Record<string, unknown> | undefined;
                } | null;
                description: string;
                grants: Record<string, "none" | "read" | "write">;
                name: string;
                scopes: string[];
            };
            tags: string[];
            created_at: string;
            is_current: boolean;
        }[];
        audit: {
            version: number;
            body: {
                action: string;
                actor: string | null;
                before: unknown;
                after: unknown;
            };
            tags: string[];
            created_at: string;
            is_current: boolean;
        }[];
    }>;
    rollbackRole: (name: string, version: number) => Promise<{
        allow_all: boolean;
        base_tier: string | null;
        condition: {
            content?: string | undefined;
            id?: string | undefined;
            kwargs?: Record<string, unknown> | undefined;
        } | null;
        description: string;
        grants: Record<string, "none" | "read" | "write">;
        name: string;
        scopes: string[];
    }>;
    listTokensPayload: (signal?: AbortSignal) => Promise<{
        user_id: string;
        description: string;
        scopes: string[];
        policy_data: unknown;
        condition?: {
            content?: string | undefined;
            id?: string | undefined;
            kwargs?: Record<string, unknown> | undefined;
        } | null | undefined;
        principal?: {
            user_id: string;
            kind: "human" | "service";
            display_name: string;
        } | null | undefined;
        orphaned?: boolean | undefined;
    }[]>;
    createApiKey: (body: ApiKeyBody) => Promise<string>;
    editApiKey: (userId: string, body: Omit<ApiKeyBody, "user_id">) => Promise<{
        user_id: string;
        updated: boolean;
    }>;
    revokeApiKey: (userId: string) => Promise<{
        user_id: string;
        revoked: boolean;
    }>;
    createClaimLink: (body: ClaimLinkBody) => Promise<{
        claim_path: string;
        token: string;
        expires_at: string;
    }>;
    listPrincipals: (signal?: AbortSignal) => Promise<{
        user_id: string;
        kind: "human" | "service";
        display_name: string;
        created_by: string | null;
        disabled: boolean;
        created_at: string;
    }[]>;
    createPrincipal: (body: {
        user_id?: string;
        kind: "human" | "service";
        display_name: string;
        role: string;
    }) => Promise<{
        user_id: string;
        kind: "human" | "service";
        display_name: string;
        created_by: string | null;
        disabled: boolean;
        created_at: string;
    }>;
    updatePrincipal: (userId: string, body: {
        display_name?: string;
        disabled?: boolean;
    }) => Promise<{
        user_id: string;
        kind: "human" | "service";
        display_name: string;
        created_by: string | null;
        disabled: boolean;
        created_at: string;
    }>;
    deletePrincipal: (userId: string) => Promise<{
        user_id: string;
        deleted: boolean;
    }>;
};
//# sourceMappingURL=auth-client.d.ts.map