/**
 * Bootstrap flow for creating the first account.
 *
 * Uses an atomic `bootstrap_lock` table to prevent TOCTOU race conditions.
 * Token verification and account creation happen in a single transaction.
 *
 * @module
 */
import type { Logger } from '@fuzdev/fuz_util/log.js';
import type { PasswordHashDeps } from './password.js';
import { ERROR_INVALID_TOKEN, ERROR_ALREADY_BOOTSTRAPPED, ERROR_TOKEN_FILE_MISSING } from '../http/error_schemas.js';
import type { Account, Actor, RoleGrant } from './account_schema.js';
import type { Db } from '../db/db.js';
/** Input for the bootstrap account creation. */
export interface BootstrapAccountInput {
    username: string;
    password: string;
}
/** Successful bootstrap result with the created entities. */
export interface BootstrapAccountSuccess {
    ok: true;
    account: Account;
    actor: Actor;
    role_grants: {
        keeper: RoleGrant;
        admin: RoleGrant;
    };
    /** Whether the bootstrap token file was successfully deleted after account creation. */
    token_file_deleted: boolean;
}
/** Bootstrap failure result. */
export type BootstrapAccountFailure = {
    ok: false;
    error: typeof ERROR_ALREADY_BOOTSTRAPPED;
    status: 403;
} | {
    ok: false;
    error: typeof ERROR_TOKEN_FILE_MISSING;
    status: 404;
} | {
    ok: false;
    error: typeof ERROR_INVALID_TOKEN;
    status: 401;
};
/** Bootstrap account result — either success or a bootstrap verification failure. */
export type BootstrapAccountResult = BootstrapAccountSuccess | BootstrapAccountFailure;
/**
 * Dependencies for `bootstrap_account`.
 */
export interface BootstrapAccountDeps {
    db: Db;
    /** Path to the bootstrap token file on disk. */
    token_path: string;
    /** Read a file's contents as a string. */
    read_text_file: (path: string) => Promise<string>;
    /** Delete a file. */
    delete_file: (path: string) => Promise<void>;
    /** Only hashing is needed — verification happens separately during login. */
    password: Pick<PasswordHashDeps, 'hash_password'>;
    /** Structured logger instance. */
    log: Logger;
}
/**
 * Bootstrap the first account with keeper and admin privileges.
 *
 * Uses an atomic `bootstrap_lock` UPDATE to prevent concurrent bootstrap
 * attempts (TOCTOU). The full flow runs in a single transaction:
 *
 * 1. Read and verify the bootstrap token (before transaction)
 * 2. Hash the password (CPU-intensive, before transaction)
 * 3. Acquire the bootstrap lock atomically (inside transaction)
 * 4. Create account + actor
 * 5. Grant keeper and admin role_grants (no expiry, `granted_by = null`)
 * 6. Delete the token file (after commit, reported via `token_file_deleted`)
 *
 * @param deps - database, token path, filesystem callbacks, and password hashing
 * @param provided_token - the bootstrap token from the user
 * @param input - username and password
 * @returns the created account, actor, and role_grants — or a bootstrap failure
 * @mutates `bootstrap_lock` row - flips `bootstrapped` to `true` atomically
 * @mutates `account` / `actor` / `role_grant` tables - inserts the bootstrap account, actor, and the keeper + admin role_grants
 * @mutates filesystem - deletes the bootstrap token file after commit (reported via `token_file_deleted`)
 */
export declare const bootstrap_account: (deps: BootstrapAccountDeps, provided_token: string, input: BootstrapAccountInput) => Promise<BootstrapAccountResult>;
//# sourceMappingURL=bootstrap_account.d.ts.map