/**
 * User subsystem startup for the multi-tenant gateway.
 *
 * Initializes and wires together:
 * - Channel identity map (channel sender -> hub user ID resolution)
 * - Token revocation store (revoked JWT rejection)
 * - Usage tracker (per-user token consumption)
 * - Hub push event handlers for real-time updates
 *
 * Called during gateway startup after event system init and before channels start.
 */
import type { ChannelIdentityEntry } from "../../users/channel-identity-map.js";
import { type ChannelIdentityMap } from "../../users/channel-identity-map.js";
import { type TokenRevocationStore } from "../../users/token-revocation.js";
import type { UserRole } from "../../users/types.js";
import { type UsageTracker } from "../../users/usage-tracker.js";
import type { GatewayWsClient } from "../server/ws-types.js";
import type { GatewayBroadcastToConnIdsFn } from "./server-broadcast.js";
/** Get the currently active user subsystem, or null if not initialized. */
export declare function getActiveUserSubsystem(): UserSubsystem | null;
/** The initialized user subsystem, stored on gateway runtime state. */
export type UserSubsystem = {
    channelIdentityMap: ChannelIdentityMap;
    tokenRevocationStore: TokenRevocationStore;
    usageTracker: UsageTracker;
    shutdown: () => void;
};
export type InitUserSubsystemParams = {
    /** Resolved gateway configuration. */
    multiTenantConfig?: {
        oidcIssuers?: {
            url: string;
            audience: string;
        }[];
    };
    /** Gateway state directory path. */
    stateDir: string;
    /** All active WebSocket clients. */
    clients: Set<GatewayWsClient>;
    /** Targeted broadcast to specific connection IDs. */
    broadcastToConnIds: GatewayBroadcastToConnIdsFn;
    /** Log helpers. */
    log: {
        info: (msg: string) => void;
        warn: (msg: string) => void;
    };
    /** Optional hub URL for initial channel identity fetch. */
    hubUrl?: string;
    /** Optional function to fetch channel identity mappings from hub. */
    fetchChannelIdentities?: () => Promise<ChannelIdentityEntry[]>;
};
/**
 * Initialize the multi-tenant user subsystem.
 *
 * Creates channel identity map, token revocation store, and usage tracker.
 * When OIDC issuers are configured, starts periodic identity map refresh
 * and registers hub push event handlers.
 */
export declare function initUserSubsystem(params: InitUserSubsystemParams): Promise<UserSubsystem>;
/**
 * Handle hub.assignment.changed push event.
 *
 * Updates all active connections for the affected user with new agent assignments.
 * Per research pitfall #5: processes per-connection, not as global broadcast.
 */
export declare function handleHubAssignmentChanged(params: {
    userId: string;
    agentIds: string[];
    role?: UserRole;
    clients: Set<GatewayWsClient>;
    broadcastToConnIds: GatewayBroadcastToConnIdsFn;
}): void;
/**
 * Provision user directory on first connect (idempotent).
 *
 * Called after successful JWT validation in the connect flow.
 * Safe to call on every connect since provisionUserDirectory
 * uses recursive mkdir.
 */
export declare function provisionOnConnect(params: {
    stateDir: string;
    userId: string;
    log: {
        warn: (msg: string) => void;
    };
}): Promise<void>;
