import type { AuthOrganizationId, AuthOrganizationMembershipRole, AuthSessionId, AuthSessionResource, AuthSignInResponse, AuthUserId } from "@termfleet/core/contracts/auth.js";
import { type Scope } from "@termfleet/core/teams/provider-access-token.js";
export type RegistryAuthState = {
    users: SeededAuthUserRecord[];
    organizations: SeededAuthOrganizationRecord[];
    memberships: SeededAuthMembershipRecord[];
    sessions: SeededAuthSessionRecord[];
};
export type SeededAuthUserRecord = {
    id: AuthUserId;
    email: string;
    firstName: string;
    lastName: string;
    passwordHash: string;
    createdAt: number;
    updatedAt: number;
};
export type SeededAuthOrganizationRecord = {
    id: AuthOrganizationId;
    name: string;
    slug: string;
    createdBy: AuthUserId;
    createdAt: number;
    updatedAt: number;
    tokenScopeCeiling?: Scope[];
};
export type SeededAuthMembershipRecord = {
    id: string;
    userId: AuthUserId;
    organizationId: AuthOrganizationId;
    role: AuthOrganizationMembershipRole;
    createdAt: number;
    updatedAt: number;
};
export type SeededAuthSessionRecord = {
    id: AuthSessionId;
    tokenHash: string;
    userId: AuthUserId;
    activeOrganizationId: AuthOrganizationId | null;
    status: "active" | "ended";
    lastActiveAt: number;
    expireAt: number;
    abandonAt: number;
    createdAt: number;
    updatedAt: number;
};
export type RegistryAuthStorage = {
    read(): Promise<RegistryAuthState>;
    write(state: RegistryAuthState): Promise<void>;
};
export declare class SeededRegistryAuth {
    private readonly storage;
    constructor(storage: RegistryAuthStorage);
    signIn(identifier: string, password: string): Promise<AuthSignInResponse>;
    issueLocalOwnerSession(identifier: string): Promise<AuthSignInResponse>;
    currentSession(token: string | null): Promise<AuthSessionResource>;
    organizationById(organizationId: AuthOrganizationId): Promise<SeededAuthOrganizationRecord | undefined>;
    switchOrganization(token: string | null, organizationId: AuthOrganizationId): Promise<AuthSessionResource>;
    refreshSession(token: string | null): Promise<AuthSessionResource>;
    signOut(token: string | null): Promise<{
        object: "session";
        id: AuthSessionId;
        status: "ended";
    } | {
        object: "session";
        status: "missing";
    }>;
    private defaultActiveOrganizationId;
}
export declare function createSeededAuthState(now?: number): RegistryAuthState;
export declare function normalizeAuthState(payload: unknown): RegistryAuthState;
export declare function registryAuthStatus(error: unknown): number;
export declare class RegistryAuthError extends Error {
    readonly status: number;
    constructor(message: string, status: number);
}