import { ServerAccessTokenOptions } from './getServerIdentity';
export interface AuthorityClientOptions extends ServerAccessTokenOptions {
    /**
     * Base URL of the Authority. Defaults to `process.env.PROCESSCUBE_AUTHORITY_URL`.
     */
    authorityUrl?: string;
}
export interface AuthorityResponse<T = unknown> {
    ok: boolean;
    status: number;
    data: T;
}
/**
 * Client for the ProcessCube Authority API.
 *
 * **Stufe 1 — Allgemein:** Use {@link request} for arbitrary Authority API calls.
 * The client handles authentication (access token in cookie) automatically.
 *
 * **Stufe 2 — ProcessCube-spezifisch:** Convenience methods for common user admin operations:
 * {@link updateClaim}, {@link addScope}, {@link addGroup}, {@link deleteUser}.
 */
export declare class AuthorityClient {
    private readonly authorityUrl;
    private readonly tokenOptions;
    constructor(options?: AuthorityClientOptions);
    /**
     * Sends an authenticated request to the Authority API.
     *
     * The access token is automatically fetched (and cached) via {@link getServerAccessToken}.
     * It is sent as a cookie (`access_token=...`).
     *
     * @param method HTTP method (GET, POST, PATCH, PUT, DELETE)
     * @param path   Path relative to the authority URL (e.g. `/acr/username_password/admin/user/...`)
     * @param body   Optional request body (will be JSON-serialized)
     * @returns Typed {@link AuthorityResponse} with status, ok flag, and parsed JSON data.
     */
    request<T = unknown>(method: string, path: string, body?: unknown): Promise<AuthorityResponse<T>>;
    private userAdminPath;
    /**
     * Updates a claim on a user account.
     *
     * @param username The username (typically the email address)
     * @param claimName  Name of the claim to set
     * @param claimValue Value of the claim
     */
    updateClaim(username: string, claimName: string, claimValue: unknown): Promise<AuthorityResponse>;
    /**
     * Adds a scope to a user account.
     *
     * @param username  The username (typically the email address)
     * @param scopeName Name of the scope to add
     */
    addScope(username: string, scopeName: string): Promise<AuthorityResponse>;
    /**
     * Adds a user to a group.
     *
     * @param username  The username (typically the email address)
     * @param groupName Name of the group to add the user to
     */
    addGroup(username: string, groupName: string): Promise<AuthorityResponse>;
    /**
     * Deletes (or soft-deletes) a user account.
     *
     * @param username The username (typically the email address)
     * @param options  Delete options. `fullDelete: false` (default) performs a soft delete.
     */
    deleteUser(username: string, options?: {
        fullDelete?: boolean;
    }): Promise<AuthorityResponse<{
        username?: string;
    }>>;
}