export interface OAuthCredentialOwner {
    scope: "user" | "org";
    id: string;
}
export interface OAuthCredentialIdentity {
    provider: string;
    accountId: string;
    resource: string;
    owner: OAuthCredentialOwner;
}
export interface OAuthCredentialTokens {
    access_token: string;
    refresh_token?: string;
    [key: string]: unknown;
}
interface OAuthLifecycleMetadata {
    version: 1;
    provider: string;
    resource: string;
    owner: string;
    reconnectReason?: "refresh_failed";
}
export interface OAuthCredential {
    tokens: OAuthCredentialTokens;
    tokenExpiresAt?: number;
    oauthLifecycle?: OAuthLifecycleMetadata;
    [key: string]: unknown;
}
interface CredentialSnapshot<T extends OAuthCredential> {
    credential: T;
    revision: number;
    legacyRevision: number;
}
export type OAuthCredentialState<T extends OAuthCredential = OAuthCredential> = {
    kind: "missing";
} | {
    kind: "malformed";
    revision: number;
    legacyRevision: number;
    reason: "structure" | "identity" | "validation";
} | ({
    kind: "connected" | "expired" | "reconnect_required";
} & CredentialSnapshot<T>);
export interface OAuthCredentialAccessResult<T extends OAuthCredential = OAuthCredential> {
    state: OAuthCredentialState<T>;
    accessToken: string | null;
    refreshFailure?: "transient";
}
export interface OAuthRefreshContext<T extends OAuthCredential> {
    identity: OAuthCredentialIdentity;
    credential: T;
}
export interface OAuthRevocationResult {
    remote: "succeeded" | "failed" | "unsupported" | "not_attempted";
    local: "deleted" | "missing" | "replaced";
}
interface LifecycleDependencies {
    now: () => number;
    sleep: (ms: number) => Promise<void>;
    holderId: () => string;
}
export declare function saveOAuthCredential<T extends OAuthCredential>(identity: OAuthCredentialIdentity, credential: T, options?: {
    legacyAccountKey?: boolean;
}): Promise<void>;
export declare function readOAuthCredentialState<T extends OAuthCredential = OAuthCredential>(identity: OAuthCredentialIdentity, options?: {
    allowLegacy?: boolean;
    legacyAccountKey?: boolean;
    now?: number;
    validateCredential?: (credential: T) => boolean;
}): Promise<OAuthCredentialState<T>>;
export declare function markOAuthReconnectRequired<T extends OAuthCredential = OAuthCredential>(identity: OAuthCredentialIdentity, options?: {
    allowLegacy?: boolean;
    legacyAccountKey?: boolean;
    validateCredential?: (credential: T) => boolean;
}): Promise<boolean>;
export declare function resolveOAuthCredentialAccess<T extends OAuthCredential = OAuthCredential>(identity: OAuthCredentialIdentity, options: {
    refresh: (context: OAuthRefreshContext<T>) => Promise<T>;
    allowLegacy?: boolean;
    legacyAccountKey?: boolean;
    validateCredential?: (credential: T) => boolean;
    shouldMarkReconnectRequiredOnRefreshFailure?: (error: unknown) => boolean;
    expirySkewMs?: number;
    /**
     * Refresh even though the stored token has not expired (or has no
     * expiry): the caller just saw it refused. A refresh another holder
     * finishes meanwhile satisfies it.
     */
    forceRefresh?: boolean;
    leaseMs?: number;
    waitMs?: number;
    maxWaitMs?: number;
    dependencies?: Partial<LifecycleDependencies>;
}): Promise<OAuthCredentialAccessResult<T>>;
/**
 * Refresh a flat OAuth token row under the lifecycle lease, with provider
 * network I/O outside database transactions and a revision check on save.
 */
export declare function resolveOAuthTokenBundleAccess<T = OAuthCredentialTokens>(identity: OAuthCredentialIdentity, options: {
    storageOwner: string;
    shouldRefresh: (tokens: T, now: number) => boolean;
    refresh: (tokens: T) => Promise<T>;
    leaseMs?: number;
    waitMs?: number;
    maxWaitMs?: number;
    dependencies?: Partial<LifecycleDependencies>;
}): Promise<T>;
export declare function revokeOAuthCredential<T extends OAuthCredential>(identity: OAuthCredentialIdentity, options?: {
    revoke?: (context: OAuthRefreshContext<T>) => Promise<"succeeded" | "unsupported">;
    allowLegacy?: boolean;
    legacyAccountKey?: boolean;
    validateCredential?: (credential: T) => boolean;
}): Promise<OAuthRevocationResult>;
export {};