import type * as plugins from './plugins.js';
import type { IControllerRuntimeId } from '../dist_ts_interfaces/index.js';
import type { IControllerRuntimeConfig } from './interfaces.config.js';
export type TControllerAuthLifecycleState = 'setupRequired' | 'ready';
export type TWebAuthnCeremonyKind = 'setup' | 'authentication';
export type TWebAuthnCeremonyState = 'pending' | 'consumed';
/**
 * Single source of the audit event vocabulary: the persisted-document
 * assertion consumes this list at runtime, so a type added here is
 * automatically storable — the two can no longer drift apart.
 */
export declare const controllerAuditEventTypes: readonly ["controller.started", "controller.stopped", "setup.finish", "authentication.finish", "authentication.logout", "temppassword.create", "temppassword.login", "auth.resume", "session.list", "conversation.list", "conversation.search", "conversation.open", "conversation.archive", "conversation.reopen", "session.read", "session.auxiliary.read", "session.model.update", "session.mode.update", "session.scratchpad.save", "session.intelligence.ask", "session.messages.page", "session.message.read", "session.create", "session.delete", "session.discard-empty", "session.send", "session.abort", "session.rename", "session.archive", "session.yolo", "session.builtin", "slash.list", "slash.execute", "permission.reply", "question.reply", "project.list", "project.create", "project.remove", "project.removal.retry", "model.list", "provider.list", "provider.connection.list", "provider.login.begin", "authswitch.request", "provider.login.read", "provider.login.cancel", "provider.connection.logout", "provider.connection.activate-opencode", "provider.connection.ratelimits.read", "provider.model.refresh.begin", "provider.model.refresh.read", "command.list", "session.command", "settings.read", "settings.update", "sessiongroups.read", "sessiongroups.update", "terminal.list", "terminal.create", "terminal.rename", "terminal.remove", "terminal.attach", "resource.list", "resource.create", "resource.rename", "resource.attach", "resource.detach", "resource.start", "resource.stop", "resource.retire", "resource.browser.operation", "resource.browser.view.open", "resource.browser.view.close", "resource.browser.view.operate"];
export type TControllerAuditEventType = (typeof controllerAuditEventTypes)[number];
export type TControllerAuditOutcome = 'attempted' | 'succeeded' | 'denied' | 'failed';
export type TAuthErrorCode = 'not_initialized' | 'config_mismatch' | 'setup_unavailable' | 'setup_invalid' | 'setup_expired' | 'rate_limited' | 'ceremony_limit' | 'ceremony_invalid' | 'ceremony_replayed' | 'ceremony_expired' | 'origin_mismatch' | 'peer_mismatch' | 'verification_failed' | 'credential_not_found' | 'concurrent_change' | 'ambiguous_write' | 'counter_conflict' | 'invalid_project' | 'invalid_resource' | 'temp_password_invalid' | 'temp_password_limit';
export declare class AuthError extends Error {
    readonly code: TAuthErrorCode;
    constructor(codeArg: TAuthErrorCode, messageArg: string, optionsArg?: ErrorOptions);
}
export interface IStoredPasskeyCredential {
    id: string;
    publicKey: string;
    counter: number;
    transports: plugins.simplewebauthnServer.AuthenticatorTransportFuture[];
    deviceType: plugins.simplewebauthnServer.CredentialDeviceType;
    backedUp: boolean;
    createdAt: Date;
    counterUpdateId: string;
}
export interface ISetupAuthorityState {
    generation: string;
    hash: string;
    expiresAt: Date;
}
export interface IControllerAuthDocument {
    id: string;
    config: IControllerRuntimeConfig;
    authState: TControllerAuthLifecycleState;
    setup: ISetupAuthorityState | null;
    webauthnUserId: string;
    credentials: IStoredPasskeyCredential[];
}
export interface IWebAuthnCeremonyDocument {
    id: string;
    kind: TWebAuthnCeremonyKind;
    state: TWebAuthnCeremonyState;
    peerId: string;
    challenge: string;
    origin: string;
    rpId: string;
    userId: string;
    createdAt: Date;
    expiresAt: Date;
    consumedAt?: Date;
    consumedNonce?: string;
    setupGeneration?: string;
    setupHash?: string;
}
export interface IWebAuthnSetupCeremonyDocument extends IWebAuthnCeremonyDocument {
    kind: 'setup';
    setupGeneration: string;
    setupHash: string;
}
export interface IWebAuthnAuthenticationCeremonyDocument extends IWebAuthnCeremonyDocument {
    kind: 'authentication';
    setupGeneration?: never;
    setupHash?: never;
}
export interface ISetupAuthority {
    setupCode: string;
    generation: string;
    expiresAt: Date;
}
/**
 * The conversation an audited action acted as. Normally an AGL runtime id. A browser operation
 * driven by the Claude Code conversation that owns an attached terminal names that conversation
 * instead: AGL does not manage it and has no runtime id for it, so it is recorded exactly as
 * BrowserRuntime qualifies it.
 */
export type TControllerAuditSessionId = IControllerRuntimeId | plugins.browserRuntime.IBrowserClaudeSessionId;
export interface IControllerAuditEvent {
    id: string;
    controllerId: string;
    timestamp: Date;
    type: TControllerAuditEventType;
    outcome: TControllerAuditOutcome;
    operationId?: string;
    peerId?: string;
    credentialId?: string;
    sessionId?: TControllerAuditSessionId;
    requestId?: IControllerRuntimeId;
}
export interface IControllerTempPasswordDocument {
    id: string;
    controllerId: string;
    /** base64url SHA-256 of the plaintext; the plaintext is never stored. */
    secretHash: string;
    createdAt: Date;
    expiresAt: Date;
}
export interface IMintedTempPassword {
    /** Plaintext credential, shown once by the CLI and never persisted. */
    password: string;
    credentialId: string;
    expiresAt: Date;
}
export interface IRecordAuditEventInput {
    timestamp?: Date;
    type: TControllerAuditEventType;
    outcome: TControllerAuditOutcome;
    operationId?: string;
    peerId?: string;
    credentialId?: string;
    sessionId?: TControllerAuditSessionId;
    requestId?: IControllerRuntimeId;
}
export interface IConsumeCeremonyOptions {
    ceremonyId: string;
    kind: TWebAuthnCeremonyKind;
    peerId: string;
    origin: string;
    rpId: string;
    userId: string;
    now: Date;
}
export interface IAuthStore {
    init(): Promise<void>;
    close(): Promise<void>;
    getRuntimeConfig(controllerPortArg: number): Promise<IControllerRuntimeConfig | undefined>;
    resolveOrCreateRuntimeConfig(runtimeConfigArg: IControllerRuntimeConfig): Promise<IControllerAuthDocument>;
    rotateSetupAuthority(): Promise<ISetupAuthority | null>;
    getState(): Promise<IControllerAuthDocument>;
    assertSetupAuthority(setupCodeArg: string, ceremonyArg?: IWebAuthnSetupCeremonyDocument, nowArg?: Date): Promise<IControllerAuthDocument>;
    countActiveCeremonies(kindArg: TWebAuthnCeremonyKind, nowArg: Date): Promise<number>;
    createCeremony(ceremonyArg: IWebAuthnCeremonyDocument): Promise<IWebAuthnCeremonyDocument>;
    assertPendingCeremony(optionsArg: IConsumeCeremonyOptions): Promise<IWebAuthnCeremonyDocument>;
    consumeCeremony(optionsArg: IConsumeCeremonyOptions): Promise<IWebAuthnCeremonyDocument>;
    commitFirstCredential(ceremonyArg: IWebAuthnSetupCeremonyDocument, credentialArg: IStoredPasskeyCredential): Promise<IControllerAuthDocument>;
    updateCounter(credentialIdArg: string, expectedCounterArg: number, newCounterArg: number): Promise<IStoredPasskeyCredential>;
    recordAuditEvent(eventArg: IRecordAuditEventInput): Promise<IControllerAuditEvent>;
}
export interface IWebAuthnServerImplementation {
    generateRegistrationOptions: typeof plugins.simplewebauthnServer.generateRegistrationOptions;
    verifyRegistrationResponse: typeof plugins.simplewebauthnServer.verifyRegistrationResponse;
    generateAuthenticationOptions: typeof plugins.simplewebauthnServer.generateAuthenticationOptions;
    verifyAuthenticationResponse: typeof plugins.simplewebauthnServer.verifyAuthenticationResponse;
}
export interface IPasskeyManagerOptions {
    store: IAuthStore;
    relyingPartyName?: string;
    webAuthn?: IWebAuthnServerImplementation;
    now?: () => Date;
    setupAttemptLimit?: number;
    setupAttemptWindowMs?: number;
    authenticationAttemptLimitPerPeer?: number;
    authenticationAttemptWindowMs?: number;
    maxActiveSetupCeremonies?: number;
    maxActiveAuthenticationCeremonies?: number;
}
export interface ISetupBeginOptions {
    peerId: string;
    origin: string;
    setupCode: string;
}
export interface ISetupFinishOptions extends ISetupBeginOptions {
    ceremonyId: string;
    response: plugins.simplewebauthnServer.RegistrationResponseJSON;
}
export interface IAuthenticationBeginOptions {
    peerId: string;
    origin: string;
}
export interface IAuthenticationFinishOptions extends IAuthenticationBeginOptions {
    ceremonyId: string;
    response: plugins.simplewebauthnServer.AuthenticationResponseJSON;
}
export interface ISetupBeginResult {
    ceremonyId: string;
    options: plugins.simplewebauthnServer.PublicKeyCredentialCreationOptionsJSON;
}
export interface IAuthenticationBeginResult {
    ceremonyId: string;
    options: plugins.simplewebauthnServer.PublicKeyCredentialRequestOptionsJSON;
}
export interface IAuthenticationResult {
    authenticated: true;
    credentialId: string;
}