import type { CapgoClient } from '../utils';
/** What a command needs checked before it acts. The backend owns every rule. */
export interface CliPreflightRequest {
    appId?: string;
    orgId?: string;
    channelId?: number | null;
    /** RBAC permission the command needs, scoped to channel, app or org. */
    permission?: string;
    /** Enforce the org 2FA policy (default true). */
    check2fa?: boolean;
    /** Metered plan gate: `all` for usage commands, `upload` for storage-only. */
    plan?: 'all' | 'upload';
    /** Show org CLI warnings targeted at this CLI version. */
    cliVersion?: string;
}
export interface CliPreflightResult {
    userId: string | null;
    orgId: string | null;
    appId: string | null;
    trialDaysLeft: number | null;
    warnings: Array<{
        message: string;
        fatal: boolean;
    }>;
}
export interface CliPreflightOptions {
    silent?: boolean;
    /** Print the unpaid-trial reminder (default true). */
    warnTrial?: boolean;
    /** Message for `app_not_found`; defaults to the `app add` hint. */
    appNotFoundMessage?: string;
    /** Logged message for `permission_denied`; defaults to the missing permission key. */
    permissionDeniedMessage?: string;
    /** Thrown error message for `permission_denied` (stable for telemetry); defaults to the logged one. */
    permissionDeniedErrorMessage?: string;
    /** Organization name for the 2FA denial banner. */
    organizationName?: string;
    telemetryFunctionName?: string;
}
/**
 * One backend call before a command acts: 2FA policy, app visibility, RBAC
 * permission, metered plan and org CLI warnings. Denials are rendered and thrown;
 * the result carries what the command needs next. Returns null only when Capgo is
 * unreachable after retries and 2FA was requested: the command continues and the
 * backend still enforces every rule on the real action.
 */
export declare function runCliPreflight(client: CapgoClient, request: CliPreflightRequest, options?: CliPreflightOptions): Promise<CliPreflightResult | null>;
/** Fail unless the org's 2FA policy lets this key act on it. */
export declare function check2FAAccessForOrg(client: CapgoClient, orgId: string, silent?: boolean): Promise<void>;
/** Fail unless the org plan allows usage (all metered actions); warns on unpaid trials. */
export declare function checkPlanValid(client: CapgoClient, orgId: string, appId?: string, warning?: boolean): Promise<void>;
/** Fail unless the org plan allows storage; warns on unpaid trials. */
export declare function checkPlanValidUpload(client: CapgoClient, orgId: string, appId?: string, warning?: boolean): Promise<void>;