/**
 * Account route specs for cookie-based session management.
 *
 * Returns `RouteSpec[]` — caller applies them to Hono via `apply_route_specs`.
 *
 * Four REST flows remain here; each has a concrete reason to stay REST
 * rather than moving to `auth/account_actions.ts`:
 *
 * - `POST /login` — issues a signed `Set-Cookie` and pre-handler rate-limits
 *   by IP + per-canonical-account before password hashing.
 * - `POST /logout` — clears the session cookie.
 * - `POST /password` — cookie clear + revoke-all cascade; rate-limit-shaped
 *   error envelope on 429.
 * - `GET /verify` — empty-body nginx `auth_request` probe. Programmatic
 *   callers should use the `account_verify` RPC action for the typed payload.
 *
 * Session listing/revocation and API token CRUD are on the RPC endpoint —
 * see `auth/account_actions.ts`. Signup is in `auth/signup_routes.ts`. Defaults are
 * closed/safe: accounts are created through bootstrap, admin action, or
 * invite.
 *
 * @module
 */
import { z } from 'zod';
import type { SessionOptions } from './session_cookie.js';
import { type RouteSpec } from '../http/route_spec.js';
import { type RateLimiter } from '../rate_limiter.js';
import type { RouteFactoryDeps } from './deps.js';
import type { ConnectionCloser } from '../actions/connection_closer.js';
/** Input for `GET /api/account/status`. No parameters — caller is the subject. */
export declare const AccountStatusInput: z.ZodNull;
export type AccountStatusInput = z.infer<typeof AccountStatusInput>;
/**
 * Output for `GET /api/account/status` on the authenticated path.
 *
 * `account` is always populated for authenticated callers. `actor` and
 * `role_grants` are populated when the caller's account has a unique actor or
 * the request supplies `?acting=<actor_id>`; on multi-actor accounts
 * without an `acting` query, `actor` is `null` and `role_grants` is empty so
 * the frontend can show a persona picker without a separate roundtrip.
 */
export declare const AccountStatusOutput: z.ZodObject<{
    account: z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
        email: z.ZodNullable<z.ZodEmail>;
        email_verified: z.ZodBoolean;
        created_at: z.ZodString;
    }, z.core.$strict>;
    actor: z.ZodNullable<z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        name: z.ZodString;
    }, z.core.$strict>>;
    role_grants: z.ZodArray<z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
        role: z.ZodString;
        scope_kind: z.ZodNullable<z.ZodString>;
        scope_id: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
        created_at: z.ZodString;
        expires_at: z.ZodNullable<z.ZodString>;
        granted_by: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type AccountStatusOutput = z.infer<typeof AccountStatusOutput>;
/** Error body for `GET /api/account/status` on the unauthenticated path. */
export declare const AccountStatusUnauthenticatedError: z.ZodObject<{
    error: z.ZodLiteral<"authentication_required">;
    bootstrap_available: z.ZodOptional<z.ZodBoolean>;
}, z.core.$loose>;
export type AccountStatusUnauthenticatedError = z.infer<typeof AccountStatusUnauthenticatedError>;
/**
 * Create the account status route spec.
 *
 * Handles both authenticated and unauthenticated requests:
 * - Authenticated: returns `{account}` with 200
 * - Unauthenticated: returns 401 with optional `bootstrap_available` flag
 *
 * This eliminates the need for a separate `/health` fetch on page load —
 * the frontend gets both session state and bootstrap availability in one request.
 *
 * @param options - optional configuration (bootstrap_status for bootstrap detection)
 * @returns a single account status route spec
 */
export declare const create_account_status_route_spec: (options?: AccountStatusOptions) => RouteSpec;
/** Options for the account status route spec. */
export interface AccountStatusOptions {
    /** Override the default path (`/api/account/status`). */
    path?: string;
    /** Runtime bootstrap status — when available, 401 responses include `bootstrap_available`. */
    bootstrap_status?: {
        available: boolean;
    };
}
/** Default maximum sessions per account. */
export declare const DEFAULT_MAX_SESSIONS = 5;
/** Default maximum API tokens per account. */
export declare const DEFAULT_MAX_TOKENS = 10;
/**
 * Default minimum wall-clock time (ms) for a login failure (401) response.
 *
 * Picked to exceed the p99 of every 401 code path (Argon2id dominates at
 * ~100ms, plus DB + overhead). The handler races failure work against
 * `sleep(floor + jitter)` via `await`, so observed response time = max(work,
 * delay). Found-vs-not-found and rate-limit-skipped-vs-not paths converge.
 * Only 401 is padded — 429 stays fast by design to keep rate-limit DoS
 * handling cheap.
 */
export declare const DEFAULT_LOGIN_FAIL_FLOOR_MS = 250;
/**
 * Default uniform jitter window (±ms) layered on the floor.
 *
 * Random jitter prevents a stable clamp point from leaking whenever a path
 * occasionally exceeds the floor. `Math.random` is sufficient — we only need
 * unpredictability of the exact delay, not cryptographic guarantees.
 */
export declare const DEFAULT_LOGIN_FAIL_JITTER_MS = 25;
/**
 * Shared options for route factories that create sessions and rate-limit by IP.
 *
 * Extended by `AccountRouteOptions` and `SignupRouteOptions`.
 * Consumers can destructure these from `AppServerContext` once and spread into multiple factories.
 */
export interface AuthSessionRouteOptions {
    session_options: SessionOptions<string>;
    /** Rate limiter for auth attempts, keyed by client IP. Pass `null` to disable. */
    ip_rate_limiter: RateLimiter | null;
}
/**
 * Per-factory configuration for account route specs.
 */
export interface AccountRouteOptions extends AuthSessionRouteOptions {
    /** Rate limiter for login attempts, keyed by submitted username. Pass `null` to disable. */
    login_account_rate_limiter: RateLimiter | null;
    /** Max active sessions per account. Evicts oldest on login. Default 5, `null` disables. */
    max_sessions?: number | null;
    /**
     * Minimum wall-clock time (ms) for login 401 responses. Set to `0` or a
     * negative number to disable (e.g., in tests). Default
     * `DEFAULT_LOGIN_FAIL_FLOOR_MS`.
     */
    login_fail_floor_ms?: number;
    /**
     * Uniform jitter window (±ms) layered on the floor. Set to `0` to disable
     * jitter while keeping the floor. Default `DEFAULT_LOGIN_FAIL_JITTER_MS`.
     */
    login_fail_jitter_ms?: number;
    /**
     * Live-connection closer — when set, the `logout` and `password` handlers
     * eagerly close affected WebSocket sockets for the account BEFORE
     * emitting the corresponding audit event. Mirrors the self-service
     * action surface (see `AccountActionOptions.connection_closer`). When
     * absent, only the listener-based close (`transports_ws_auth_guard` on
     * `audit.on_event_chain`) runs.
     */
    connection_closer?: ConnectionCloser | null;
}
/** Input for `POST /login`. Accepts a username or email in the `username` field. */
export declare const LoginInput: z.ZodObject<{
    username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
    password: z.ZodString;
}, z.core.$strict>;
export type LoginInput = z.infer<typeof LoginInput>;
/** Output for `POST /login`. The signed session cookie is the operative side effect. */
export declare const LoginOutput: z.ZodObject<{
    ok: z.ZodLiteral<true>;
}, z.core.$strict>;
export type LoginOutput = z.infer<typeof LoginOutput>;
/** Input for `POST /logout`. Session identity flows through the cookie. */
export declare const LogoutInput: z.ZodNull;
export type LogoutInput = z.infer<typeof LogoutInput>;
/** Output for `POST /logout`. Includes the revoked account's username for UI redraw. */
export declare const LogoutOutput: z.ZodObject<{
    ok: z.ZodLiteral<true>;
    username: z.ZodString;
}, z.core.$strict>;
export type LogoutOutput = z.infer<typeof LogoutOutput>;
/** Input for `POST /password`. `current_password` is minimally validated; `new_password` enforces the full policy. */
export declare const PasswordChangeInput: z.ZodObject<{
    current_password: z.ZodString;
    new_password: z.ZodString;
}, z.core.$strict>;
export type PasswordChangeInput = z.infer<typeof PasswordChangeInput>;
/** Output for `POST /password`. Counts are returned so the UI can summarize the revoke-all cascade. */
export declare const PasswordChangeOutput: z.ZodObject<{
    ok: z.ZodLiteral<true>;
    sessions_revoked: z.ZodNumber;
    tokens_revoked: z.ZodNumber;
}, z.core.$strict>;
export type PasswordChangeOutput = z.infer<typeof PasswordChangeOutput>;
/**
 * Create account route specs for session-based auth.
 *
 * The returned specs cover the three flows that stay REST after the RPC
 * migration (login, logout, password change). Self-service session/token
 * management and verify are on `auth/account_actions.ts`.
 *
 * @param deps - stateless capabilities (keyring, password, log)
 * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter)
 * @returns route specs (not yet applied to Hono)
 */
export declare const create_account_route_specs: (deps: RouteFactoryDeps, options: AccountRouteOptions) => Array<RouteSpec>;
//# sourceMappingURL=account_routes.d.ts.map