/**
 * @license
 * Copyright 2026 Amodal Labs, Inc.
 * SPDX-License-Identifier: MIT
 */
/**
 * Studio-side mirror of the runtime's `AuthConfig` discriminated union.
 *
 * Why duplicated rather than imported from `@amodalai/runtime`: Studio's
 * UI needs to render and edit a normalized shape *before* the runtime
 * has parsed it (e.g. when amodal.json hasn't loaded yet, or when the
 * user is in the middle of typing an invalid value). The runtime's
 * `AuthConfig` is the strict shape; this is the editable mirror with
 * sensible defaults for empty fields.
 *
 * The Studio API serializer normalizes Studio's draft shape back to
 * `AuthConfig` before writing it to amodal.json, so the disk format
 * always matches the runtime contract.
 */
export declare const AUTH_CONFIG_FILE_PATH = "amodal.json";
export declare const AUTH_CONFIG_API_PATH = "/api/auth-config";
export declare const AUTH_CONFIG_COMMIT_API_PATH = "/api/auth-config/commit";
export declare const AUTH_TYPES: readonly ["none", "amodal", "jwt_secret", "oidc", "header", "custom"];
export type AuthType = typeof AUTH_TYPES[number];
export declare const JWT_ALGORITHMS: readonly ["HS256", "HS384", "HS512"];
export type JwtAlgorithm = typeof JWT_ALGORITHMS[number];
/**
 * Editable form shape — every field always present (even when irrelevant
 * to the current type) so the form can hold transient state for fields
 * a user may swap to. Normalized to the runtime's strict union when
 * persisted.
 */
export interface AuthConfigDraft {
    type: AuthType;
    userId: string;
    jwtSecret: string;
    jwtAlgorithm: JwtAlgorithm;
    jwtIssuer: string;
    jwtAudience: string;
    oidcIssuer: string;
    oidcClientId: string;
    oidcClientSecret: string;
    oidcCallbackUrl: string;
    oidcScopes: string;
    oidcSessionSecret: string;
    oidcCookieName: string;
    oidcSessionTtlSeconds: string;
    headerName: string;
    customModule: string;
    amodalJwksUrl: string;
    amodalIssuer: string;
}
export declare const DEFAULT_AUTH_DRAFT: AuthConfigDraft;
export interface AuthConfigResponse {
    draft: AuthConfigDraft;
    source: 'default' | 'file' | 'draft';
}
export interface AuthConfigSaveResponse extends AuthConfigResponse {
    draftPath: typeof AUTH_CONFIG_FILE_PATH;
}
/**
 * Response from the single-file commit endpoint. Mirrors the shape of
 * change-proposals' commit result for the auth-only path: the draft we
 * committed, plus the resulting branch / commit / preview deploy info
 * the UI uses to confirm "you committed XYZ as commit abc1234".
 */
export interface AuthConfigCommitResponse {
    draft: AuthConfigDraft;
    proposalId: string;
    branch: string | null;
    commitSha: string | null;
    previewDeployId: string | null;
}
export declare class AuthConfigError extends Error {
    constructor(message: string, options?: ErrorOptions);
}
/**
 * Read an `auth` block out of amodal.json content into the editable
 * draft shape. Missing / unrecognized fields fall back to defaults.
 */
export declare function readAuthConfigFromAmodalJson(content: string): AuthConfigDraft;
/**
 * Write a draft back into amodal.json content, only emitting the fields
 * that match the selected type. Round-trips with `readAuthConfigFromAmodalJson`.
 */
export declare function writeAuthConfigToAmodalJson(content: string, draft: AuthConfigDraft): string;
/**
 * Serialize an editable draft into the strict runtime `AuthConfig` shape.
 * Only includes fields relevant to the selected type.
 */
export declare function serializeDraft(draft: AuthConfigDraft): Record<string, unknown>;
export declare function parseAmodalJson(content: string): Record<string, unknown>;
