/**
 * AuthClient Effect service — device flow login, token refresh, revocation, identity queries.
 *
 * Provides methods for the OAuth 2.0 Device Authorization Grant (RFC 8628)
 * and related auth operations against the AgentXM registry API.
 *
 * Uses the generated registry client for HTTP transport and maps all errors
 * to AppError with per-operation error codes.
 *
 * @experimental This API is unstable and may change without notice.
 */
import * as HttpClient from "effect/unstable/http/HttpClient";
import * as DateTime from "effect/DateTime";
import * as ServiceMap from "effect/Context";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import { type AppError } from "../app-error/index.js";
import { type Handle } from "../extensions/handle.js";
import { type PublishVisibility } from "../publish/visibility.js";
import { type PreviewPublicationSetRequest, type PreviewPublicationSetResponse, type Sha256Hex } from "../registry/publication-set.js";
import { type NormalizedTokenResponse } from "./oauth-contract.js";
import { RegistryUrl } from "./registry-url.js";
export declare const OIDC_LOGIN_SCOPES: readonly ["openid", "profile", "email", "offline_access"];
export declare const BASELINE_REGISTRY_LOGIN_SCOPES: readonly ["extensions:read", "account:read"];
export declare const DEFAULT_LOGIN_SCOPES: readonly ["openid", "profile", "email", "offline_access", "extensions:read", "account:read"];
export interface DeviceFlowResponse {
    readonly device_code: string;
    readonly user_code: string;
    readonly verification_uri: string;
    readonly verification_uri_complete: string;
    readonly interval: number;
    readonly expires_in: number;
}
export declare const normalizeRequestedLoginScopes: (scopes?: ReadonlyArray<string>) => ReadonlyArray<string>;
export interface LoginScopeOptions {
    readonly scopes?: ReadonlyArray<string>;
}
export interface MeResponse {
    readonly userId: string;
    readonly userHandle: Handle;
    readonly email: string;
    readonly tokenType: string;
    readonly scopes: ReadonlyArray<string>;
    readonly orgs: ReadonlyArray<{
        readonly id: string;
        readonly handle: Handle;
    }>;
}
export interface WhoamiResponse {
    readonly handle: Handle;
}
export interface TokenPermissionsRequest {
    readonly owners?: ReadonlyArray<string>;
    readonly extensions?: ReadonlyArray<string>;
    readonly permission?: "read" | "publish" | "admin";
    readonly org_permission?: "read" | "write" | "admin";
    readonly cidr?: ReadonlyArray<string>;
    readonly bypass_mfa?: boolean;
}
export interface CreateTokenParams {
    readonly name: string;
    readonly expiresIn: number;
    readonly permissions: TokenPermissionsRequest;
}
export interface CreatedTokenResponse {
    readonly id: string;
    readonly token: string;
    readonly name: string;
    readonly scopes: ReadonlyArray<string>;
    readonly permissions: unknown;
    readonly createdAt: DateTime.Utc;
    readonly expiresAt: DateTime.Utc;
}
export interface TokenListItem {
    readonly id: string;
    readonly name: string | null;
    readonly type: string;
    readonly scopes: ReadonlyArray<string>;
    readonly permissions: unknown;
    readonly createdAt: DateTime.Utc;
    readonly expiresAt: DateTime.Utc;
    readonly lastUsedAt: DateTime.Utc | null;
}
export interface TokenListResponse {
    readonly tokens: ReadonlyArray<TokenListItem>;
    readonly hasMore: boolean;
    readonly cursor: string | null;
}
export interface StepUpRequest {
    readonly requestId: string;
    readonly verificationUrl: string;
    readonly statusUrl: string;
    readonly expiresAt: string;
    readonly intervalSeconds: number;
    readonly maxAgeSeconds?: number;
    readonly action: string;
    readonly target: string;
}
export interface DeleteTokenOptions {
    readonly stepUpRequestId?: string;
}
export interface CreateTokenOptions {
    readonly stepUpRequestId?: string;
}
export interface BuildAuthorizeUrlParams {
    readonly challenge: string;
    readonly expiresAt?: DateTime.Utc;
    readonly state: string;
    readonly redirectUri: string;
    readonly scopes?: ReadonlyArray<string>;
}
export interface ExchangePkceCodeParams {
    readonly code: string;
    readonly verifier: string;
    readonly redirectUri: string;
}
export interface CreatePublishAuthorizationRequestParams {
    readonly registryUrl: string;
    readonly redirectUri: string;
    readonly state: string;
    readonly codeChallenge: string;
    readonly publicationSet: PreviewPublicationSetRequest;
}
export interface PublishAuthorizationRequestResponse {
    readonly requestId: string;
    readonly authorizationUrl: string;
    readonly expiresAt: DateTime.Utc;
}
export interface ExchangePublishAuthorizationCodeParams {
    readonly registryUrl: string;
    readonly code: string;
    readonly verifier: string;
    readonly redirectUri: string;
}
export interface PublishCapabilityResponse {
    readonly accessToken: string;
    readonly expiresAt: DateTime.Utc;
    readonly scope: string;
    readonly publishRequestId: string;
    readonly visibilityContract: "v2";
    readonly visibility: PublishVisibility;
    readonly condition: string;
    readonly publicationSetDigest: Sha256Hex;
    readonly publicationDescriptorDigest: Sha256Hex;
}
export type PublishAuthorizationExchangeResponse = {
    readonly status: "admitted";
    readonly preview: PreviewPublicationSetResponse;
    readonly grants: ReadonlyArray<PublishCapabilityResponse>;
} | {
    readonly status: "blocked";
    readonly preview: PreviewPublicationSetResponse;
    readonly grants: readonly [];
};
/** Result of a single poll iteration. */
export type PollResult = {
    readonly _tag: "Pending";
} | {
    readonly _tag: "SlowDown";
} | {
    readonly _tag: "Success";
    readonly token: NormalizedTokenResponse;
} | {
    readonly _tag: "AccessDenied";
} | {
    readonly _tag: "ExpiredToken";
};
export interface AuthClientService {
    readonly buildAuthorizeUrl: (params: BuildAuthorizeUrlParams) => string;
    readonly getAuthorizationIssuer: () => string;
    readonly exchangePkceCode: (params: ExchangePkceCodeParams) => Effect.Effect<NormalizedTokenResponse, AppError>;
    readonly createPublishAuthorizationRequest: (params: CreatePublishAuthorizationRequestParams) => Effect.Effect<PublishAuthorizationRequestResponse, AppError>;
    readonly exchangePublishAuthorizationCode: (params: ExchangePublishAuthorizationCodeParams) => Effect.Effect<PublishAuthorizationExchangeResponse, AppError>;
    readonly initiateDeviceFlow: (options?: LoginScopeOptions) => Effect.Effect<DeviceFlowResponse, AppError>;
    readonly pollDeviceToken: (deviceCode: string, interval: number) => Effect.Effect<NormalizedTokenResponse, AppError>;
    readonly refreshToken: (refreshTokenValue: string) => Effect.Effect<NormalizedTokenResponse, AppError>;
    readonly revokeToken: (token: string) => Effect.Effect<void, AppError>;
    readonly getMe: (accessToken: string) => Effect.Effect<MeResponse, AppError>;
    readonly getWhoami: (accessToken: string) => Effect.Effect<WhoamiResponse, AppError>;
    readonly createToken: (accessToken: string, params: CreateTokenParams, options?: CreateTokenOptions) => Effect.Effect<CreatedTokenResponse, AppError>;
    readonly listTokens: (accessToken: string, params?: {
        readonly limit?: number;
        readonly cursor?: string;
    }) => Effect.Effect<TokenListResponse, AppError>;
    readonly waitForStepUpRequest: (accessToken: string, statusUrl: string, intervalSeconds: number) => Effect.Effect<void, AppError>;
    readonly deleteToken: (accessToken: string, tokenId: string, options?: DeleteTokenOptions) => Effect.Effect<void, AppError>;
}
declare const AuthClient_base: ServiceMap.ServiceClass<AuthClient, "@agentxm/client-core/unstable/auth/auth-client/AuthClient", AuthClientService>;
export declare class AuthClient extends AuthClient_base {
}
export declare const readStepUpRequest: (error: AppError) => StepUpRequest | null;
/**
 * Execute a single device token poll (exported for testing).
 *
 * Transient HTTP failures are collapsed into AUTH_LOGIN_FAILED; this seam does
 * not retry on its own. For the retrying variant, use `pollDeviceToken`.
 */
export declare const pollOnce: (httpClient: HttpClient.HttpClient, registryUrl: string, deviceCode: string) => Effect.Effect<PollResult, AppError>;
export declare const AuthClientLive: Layer.Layer<AuthClient, never, HttpClient.HttpClient | RegistryUrl>;
export declare const AuthClientTest: (overrides?: Partial<AuthClientService>) => Layer.Layer<AuthClient, never, never>;
export {};
//# sourceMappingURL=auth-client.d.ts.map