import { GraphSubject, MeldClone, MeldReadState, Reference, Subject, Update } from '@m-ld/m-ld';
import { AccountOwnedId, GatewayPrincipal, KeyStore } from '../lib/index.js';
import { UserKey } from '../data/index.js';
import { AccessRequest } from './Authorization.js';
/** Abstract account */
type AccountSpec = {
    name: string;
    emails?: Iterable<string>;
    keyids?: Iterable<string>;
    admins?: Iterable<string>;
    subdomains?: Reference[];
};
export interface AccountContext {
    readonly me: GatewayPrincipal;
    readonly domain: MeldClone;
    readonly domainName: string;
    readonly keyStore: KeyStore;
    readonly rootAccountName: string;
}
export type SubdomainNaming = 'any' | 'uuid';
export type RemotesAuthType = 'anon' | 'key' | 'jwt';
export interface AccountDetails {
    emails: string[];
    naming: SubdomainNaming[];
    remotesAuth: RemotesAuthType[];
}
/**
 * Javascript representation of an Account subject in the Gateway domain.
 * Instances are ephemeral, instantiated dynamically on demand.
 */
export declare class Account {
    private readonly gateway;
    static fromJSON(gateway: AccountContext, src: GraphSubject): Account;
    static getDetails<K extends keyof AccountDetails>(state: MeldReadState, account: string, detail: K): Promise<AccountDetails[K]>;
    /** plain account name */
    readonly name: string;
    /** verifiable account identities */
    readonly emails: Set<string>;
    /** per-device keys */
    readonly keyids: Set<string>;
    /** admin (primary accountable) IRIs */
    readonly admins: Set<string>;
    /** directly-owned subdomain IRIs */
    readonly subdomains: Reference[];
    /**
     * Cache of owned entities, including indirectly via org account
     * @see loadAllOwned
     */
    private readonly allOwned;
    constructor(gateway: AccountContext, { name, emails, keyids, admins, subdomains }: AccountSpec);
    update(patch: Update): Promise<import("@m-ld/m-ld").MeldState>;
    /**
     * Activation of a gateway account with a user email.
     * @returns key config for the account
     */
    generateKey(opts: {
        email?: string;
        type?: 'rsa';
    }): Promise<import("../lib/AuthKey.js").AuthKeyConfig>;
    /**
     * TODO: Refactor awkward return type
     * @returns the user key, if the gateway is using user keys
     * @throws UnauthorizedError if the key does not belong to this account or is
     * revoked
     */
    authorise(keyid: string, access?: AccessRequest): Promise<UserKey>;
    hasAccess(state: MeldReadState, access: AccessRequest): Promise<boolean>;
    protected hasWriteAccess(state: MeldReadState, toAccount: string): Promise<boolean>;
    protected hasReadAccess(_state: MeldReadState, _iri: string, _writable: {
        [key: string]: Set<string>;
    }): Promise<boolean>;
    /**
     * Override to support additional owned subject types. Each type must be used
     * as follows:
     * 1. As the `@type` of each owned subject
     * 2. Lower-cased, as a multi-valued property (from the gateway vocabulary) of
     * each Account
     * TODO: Override in timeld
     */
    get ownedTypes(): string[];
    loadAllOwned(state: MeldReadState, type: string): Promise<Set<string>>;
    /**
     * Checks that the given keyid belongs to this account and returns the
     * corresponding user key
     * @throws UnauthorizedError if the key does not belong to this account
     */
    key(state: MeldReadState, keyid: string): Promise<UserKey>;
    /**
     * @param {MeldReadState} state
     * @returns {Promise<AccountOwnedId[]>}
     */
    allSubdomainIds(state: MeldReadState): Promise<AccountOwnedId[]>;
    toJSON(): Subject;
}
export {};