import * as plugins from './plugins.js';
/**
 * How AGL stands with the per-user account authority. Every value names a state a view shows as
 * itself; there is no value that means "something went wrong".
 *
 * - `absent`: no usable connection. `reason` says whether the authority was never installed here or
 *   is simply not running. Any snapshot still carried is last-known.
 * - `connecting`: an attempt is in flight. Distinct from `absent` so a first paint does not accuse
 *   a daemon that is about to answer.
 * - `ready`: the snapshot is current as of `lastVerifiedAt`.
 * - `incompatible`: the daemon answered with a snapshot shape this AGL does not implement.
 *   Retrying cannot help, so it is never reported as a connection failure.
 */
export type TControllerAuthorityDaemonState = 'absent' | 'connecting' | 'ready' | 'incompatible';
/**
 * Why AGL holds no usable authority connection. Every value is a state a view can name, and this is
 * the one definition of the set: the controller-side supervisor imports it rather than keeping a
 * second copy that could drift from what the browser renders.
 */
export type TControllerAuthorityUnavailableReason = 
/** The daemon's endpoints could not be located at all, so no connection was attempted. */
'not_installed'
/** The endpoints are known and the daemon did not answer. */
 | 'not_running'
/** The daemon answered with a snapshot shape this AGL does not implement. */
 | 'schema_unsupported';
/**
 * The controller-owned authority view, credential-free by construction: `snapshot` is the
 * authority's own management DTO, which its contract defines as safe for browser code.
 *
 * The browser holds none of this state itself. It renders `state`, and a stale screen is a dimmed
 * last-known snapshot rather than a flag the client has to clear.
 *
 * In-flight device operations are not part of this read. Nothing consumes them before the slice
 * that adds account actions, and the authority's operations read cannot be cancelled yet, so a
 * shutdown would have waited for it.
 */
export interface IControllerAuthorityProjection {
    state: TControllerAuthorityDaemonState;
    /** Set exactly when `state` is `absent` or `incompatible`. */
    reason: TControllerAuthorityUnavailableReason | null;
    /** The last snapshot received, kept while `absent` so a view can show it as last-known. */
    snapshot: plugins.authswitchAuthority.IAuthSwitchSnapshot | null;
    epoch: string | null;
    revision: number | null;
    /** When the daemon last delivered this snapshot. `null` until one has ever been received. */
    lastVerifiedAt: string | null;
    observedAt: string;
}
/**
 * Reads the controller's authority view.
 *
 * There is no companion polling method: a change is announced with the `accounts.changed` controller
 * event over the same push channel every other live controller state uses, and the client answers it
 * by reading this one.
 */
export interface IReq_ControllerAccountsSnapshot extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ControllerAccountsSnapshot> {
    method: 'controller.accounts.snapshot';
    request: Record<string, never>;
    response: {
        authority: IControllerAuthorityProjection;
    };
}
/**
 * The account model a view renders, named once here.
 *
 * The authority's own management DTOs are the shape; these aliases exist so browser code can name a
 * row, a login or a binding without importing the authority package, and so a contract change in
 * that package reaches every view through one file.
 */
export type TControllerAccount = plugins.authswitchAuthority.IAuthSwitchAccount;
export type TControllerAccountLogin = plugins.authswitchAuthority.IAuthSwitchLogin;
export type TControllerAccountBinding = plugins.authswitchAuthority.IAuthSwitchBinding;
export type TControllerAccountsImportInventory = plugins.authswitchImport.IAuthSwitchImportInventory;
export type TControllerAccountsImportSource = plugins.authswitchImport.IAuthSwitchImportSource;
/**
 * What the import pane got. A daemon that is not `ready` is answered by name rather than by an
 * error, because "no accounts service to ask" is an ordinary state of this host and not a fault of
 * the read.
 */
export type TControllerAccountsImportInventoryResult = {
    state: 'read';
    inventory: TControllerAccountsImportInventory;
}
/** Which non-ready daemon state refused the read; the same vocabulary the snapshot publishes. */
 | {
    state: 'unavailable';
    daemon: TControllerAuthorityDaemonState;
};
/**
 * Reads the credential-free report of the legacy account stores this host still holds.
 *
 * It is a read in the strict sense: the authority opens those stores, changes nothing and answers
 * with identity claims and digests only. Nothing is imported by this method, and no import can be
 * started from this AGL release.
 */
export interface IReq_ControllerAccountsImportInventory extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ControllerAccountsImportInventory> {
    method: 'controller.accounts.import.inventory';
    request: Record<string, never>;
    response: {
        result: TControllerAccountsImportInventoryResult;
    };
}