/**
 * Vigilbase One authenticated API client.
 * Public (unauthenticated) tools stay on VigilbaseClient / vigilbase.com.
 */
import type { AgentToolDefinition } from '../types.js';
import type { CliConfig } from './config.js';
export type OneToolExecuteResponse = {
    success: boolean;
    error?: string;
    /** `scan_unassessed`: the scanner ran but could not assess the target. */
    code?: string;
    data?: {
        toolRunId?: string;
        status?: string;
        grade?: string | null;
        gradeScore?: number | null;
        result?: Record<string, unknown> | null;
    };
};
export type OneSessionResponse = {
    session?: Record<string, unknown> | null;
    user?: {
        id?: string;
        email?: string | null;
        name?: string | null;
    } | null;
};
type ApiErrorBody = {
    error?: string;
    message?: string;
    success?: boolean;
};
/**
 * Tools that require Vigilbase One authentication (auth-required scanners).
 * Keep preference order aligned with `@vigilbase/tools` catalog
 * (`requiresAuthentication: true` entries in VIGILBASE_TOOLS).
 * Public agent tools remain available without login via vigilbase.com.
 */
export declare const ONE_AUTH_REQUIRED_TOOLS: readonly ["website-security", "react2shell", "fortibleed-check"];
export type OneAuthRequiredTool = (typeof ONE_AUTH_REQUIRED_TOOLS)[number];
export declare function isOneAuthRequiredTool(toolName: string): toolName is OneAuthRequiredTool;
/** Static catalog entries for auth-required tools (not listed on the public agent API). */
export declare const ONE_AUTH_REQUIRED_TOOL_DEFINITIONS: Record<OneAuthRequiredTool, AgentToolDefinition>;
export declare function resolveToolDefinition(toolName: string, publicTools: AgentToolDefinition[], oneBaseUrl: string): AgentToolDefinition | null;
/** Tools executable through One's authenticated `/api/tools/{tool}/execute` bridge. */
export declare const ONE_EXECUTABLE_TOOLS: readonly ["security-headers", "email-security", "website-security", "react2shell", "fortibleed-check"];
export declare function isOneExecutableTool(toolName: string): boolean;
export declare class VigilbaseOneClient {
    private readonly config;
    private accessToken;
    private readonly managed;
    /** The userinfo endpoint Identity discovery named for the last getSession, if it used Identity. */
    userinfoEndpoint?: string;
    constructor(config: CliConfig, accessToken: string, managed?: boolean);
    private request;
    /** Authenticated JSON transport shared by the One command clients. */
    requestJson<T extends ApiErrorBody = Record<string, unknown>>(path: string, init?: RequestInit, options?: {
        allowStatuses?: number[];
        /** Whether the request names a customer outside the query string (a JSON body). */
        hasCustomerScope?: boolean;
    }): Promise<T>;
    getSession(): Promise<OneSessionResponse>;
    getAccount(): Promise<Record<string, unknown>>;
    getAccountServices(): Promise<Record<string, unknown>>;
    getAccountOrganization(): Promise<Record<string, unknown>>;
    getAccountEndpoints(): Promise<Record<string, unknown>>;
    getAccountSessions(): Promise<Record<string, unknown>>;
    getAccountInvitations(): Promise<Record<string, unknown>>;
    createAccountInvitation(input: {
        email: string;
        role?: string;
    }): Promise<Record<string, unknown>>;
    getAccountBilling(): Promise<Record<string, unknown>>;
    createBillingPortal(): Promise<{
        success: boolean;
        url?: string;
    }>;
    getWatchdogTargets(): Promise<Record<string, unknown>>;
    getWatchdogScans(options?: {
        targetId?: string;
        limit?: number;
    }): Promise<Record<string, unknown>>;
    getCloudflareZones(): Promise<Record<string, unknown>>;
    getCloudflareCheckups(options?: {
        accountId?: string;
    }): Promise<Record<string, unknown>>;
    startCloudflareCheckup(options?: {
        accountId?: string;
    }): Promise<Record<string, unknown>>;
    listToolRuns(options?: {
        toolName?: string;
        limit?: number;
    }): Promise<Record<string, unknown>>;
    getToolRun(id: string): Promise<Record<string, unknown>>;
    executeTool(toolName: string, target: string): Promise<OneToolExecuteResponse>;
}
export {};