import type { ValueMap } from './collections';
import type { AppDeployTargetId } from './deploy';
import type { AppEnvironmentId } from './environments';
import type { SecretRef } from './secrets';
import type { IconSpec } from './types';
export declare const AUTH_IDENTIFIER_KINDS: readonly ["email", "phone", "username"];
export type AuthIdentifierKind = (typeof AUTH_IDENTIFIER_KINDS)[number];
export declare const AUTH_SIGN_UP_FIELDS: readonly ["email", "phone", "username", "password", "displayName", "firstName", "lastName"];
export type KnownAuthSignUpField = (typeof AUTH_SIGN_UP_FIELDS)[number];
export type AuthSignUpField = KnownAuthSignUpField | (string & {});
export declare const AUTH_OAUTH_PROVIDER_IDS: readonly ["apple", "azure", "bitbucket", "discord", "facebook", "figma", "github", "gitlab", "google", "kakao", "keycloak", "linkedin", "notion", "slack", "spotify", "twitch", "twitter", "workos", "zoom"];
export type KnownAuthOAuthProviderId = (typeof AUTH_OAUTH_PROVIDER_IDS)[number];
export type AuthOAuthProviderId = KnownAuthOAuthProviderId | (string & {});
export declare const AUTH_OAUTH_TRANSPORT_IDS: readonly ["brokeredRedirect"];
export type KnownAuthOAuthTransportId = (typeof AUTH_OAUTH_TRANSPORT_IDS)[number];
export type AuthOAuthTransportId = KnownAuthOAuthTransportId | (string & {});
export declare const AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS: readonly ["trustedCredential", "publicConfig"];
export type AuthOAuthSetupFieldPersistence = (typeof AUTH_OAUTH_SETUP_FIELD_PERSISTENCE_KINDS)[number];
export declare const AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES: readonly ["public", "secret"];
export type AuthOAuthSetupFieldSensitivity = (typeof AUTH_OAUTH_SETUP_FIELD_SENSITIVITIES)[number];
export declare const AUTH_OAUTH_SETUP_CALLBACK_ROLES: readonly ["provider", "app"];
export type AuthOAuthSetupCallbackRole = (typeof AUTH_OAUTH_SETUP_CALLBACK_ROLES)[number];
export interface AuthOAuthSetupFieldRequirement {
    readonly kind: 'field';
    /** Adapter-owned stable key. The contract does not prescribe provider-specific field names. */
    readonly key: string;
    readonly label: string;
    readonly required: boolean;
    readonly sensitivity: AuthOAuthSetupFieldSensitivity;
    readonly persistence: AuthOAuthSetupFieldPersistence;
    /** Present only when a field belongs to one application target rather than the backend setup. */
    readonly target?: AppDeployTargetId;
    readonly description?: string;
}
export interface AuthOAuthSetupCallbackRequirement {
    readonly kind: 'callback';
    readonly role: AuthOAuthSetupCallbackRole;
    readonly label: string;
    readonly required: boolean;
    /** App callbacks may be target-specific; provider/backend callbacks normally omit this. */
    readonly target?: AppDeployTargetId;
    readonly description?: string;
}
export type AuthOAuthSetupRequirement = AuthOAuthSetupFieldRequirement | AuthOAuthSetupCallbackRequirement;
/**
 * Adapter-neutral description of the OAuth setup Studio or Doctor should surface for one
 * provider/transport/environment combination. It contains requirements only, never credential
 * values, tokens, callback authorization data, or other secret material.
 */
export interface AuthOAuthSetupPlan {
    readonly provider: AuthOAuthProviderId;
    readonly transport: AuthOAuthTransportId;
    readonly environment: AppEnvironmentId;
    /** Enabled application targets considered while deriving this plan. */
    readonly targets: readonly AppDeployTargetId[];
    readonly requirements: readonly AuthOAuthSetupRequirement[];
}
/** Backend-owned setup capabilities used by administration planning, separate from runtime OAuth. */
export interface AuthOAuthSetupCapabilities {
    readonly providers: readonly AuthOAuthProviderId[];
    readonly transports: readonly AuthOAuthTransportId[];
}
export interface AuthIdentifier {
    kind: AuthIdentifierKind;
    value: string;
}
export interface AuthFlowConfig {
    signInRoute: string;
    signUpRoute?: string;
    signOutRoute?: string;
    forgotPasswordRoute?: string;
    otpRoute?: string;
    postSignInRoute: string;
    unauthorizedRoute?: string;
}
export declare const DEFAULT_AUTH_FLOW: {
    readonly signInRoute: "sign-in";
    readonly signUpRoute: "sign-up";
    readonly signOutRoute: "sign-out";
    readonly forgotPasswordRoute: "forgot-password";
    readonly postSignInRoute: "/";
    readonly unauthorizedRoute: "sign-in";
};
export declare function resolveAuthFlow(flow?: AuthFlowConfig): AuthFlowConfig;
export interface AuthSignInConfig {
    identifiers: AuthIdentifierKind[];
}
export interface AuthSignUpConfig {
    requiredFields: AuthSignUpField[];
    optionalFields?: AuthSignUpField[];
}
export interface AuthOAuthProviderConfig {
    id: AuthOAuthProviderId;
    label?: string;
    enabled?: boolean;
    scopes?: string[];
    queryParams?: Record<string, string>;
    icon?: IconSpec;
    /** Logical server-side secret reference; raw credentials must never be stored here. */
    credentialsRef?: SecretRef;
}
export interface AuthOAuthConfig {
    enabled: boolean;
    callbackRoute: string;
    providers: AuthOAuthProviderConfig[];
}
export interface AuthProviderConfig {
    provider: string;
    signIn: AuthSignInConfig;
    signUp?: AuthSignUpConfig;
    oauth?: AuthOAuthConfig;
    passwordReset?: {
        enabled: boolean;
    };
    otp?: {
        enabled: boolean;
    };
}
export interface AuthUser {
    id: string;
    email?: string;
    phone?: string;
    username?: string;
    displayName?: string;
    avatarUrl?: string;
    metadata?: Record<string, unknown>;
}
export interface AuthSession {
    accessToken: string;
    refreshToken?: string;
    expiresAt?: number;
    tokenType?: string;
    user: AuthUser;
}
export interface AuthAdapterError {
    code: string;
    message: string;
    cause?: unknown;
}
export type AuthResult<TData = void> = {
    ok: true;
    data?: TData;
} | {
    ok: false;
    error: AuthAdapterError;
};
export interface SignInInput {
    identifier: AuthIdentifier;
    password?: string;
    otp?: string;
    redirectTo?: string;
    metadata?: Record<string, unknown>;
}
export interface SignUpInput {
    identifier: AuthIdentifier;
    password?: string;
    profile?: Record<string, unknown>;
    redirectTo?: string;
    metadata?: Record<string, unknown>;
}
export interface SignOutInput {
    allDevices?: boolean;
}
export interface PasswordResetInput {
    identifier: AuthIdentifier;
    redirectTo?: string;
}
export interface VerifyOtpInput {
    identifier: AuthIdentifier;
    token: string;
    redirectTo?: string;
    metadata?: Record<string, unknown>;
}
export declare const AUTH_OAUTH_ERROR_STAGES: readonly ["start", "transport", "callback", "exchange", "session", "profile"];
export type AuthOAuthErrorStage = (typeof AUTH_OAUTH_ERROR_STAGES)[number];
export declare const AUTH_OAUTH_ERROR_CODES: readonly ["oauth_unavailable", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "authorization_failed", "authorization_attempt_not_found", "invalid_callback", "state_mismatch", "pkce_mismatch", "callback_already_completed", "code_exchange_failed", "network_error", "session_persistence_failed", "profile_creation_failed", "provider_error"];
export type AuthOAuthErrorCode = (typeof AUTH_OAUTH_ERROR_CODES)[number];
export interface AuthOAuthError extends AuthAdapterError {
    code: AuthOAuthErrorCode;
    stage: AuthOAuthErrorStage;
    provider?: AuthOAuthProviderId;
    recoverable: boolean;
}
export declare const AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS: readonly ["user_cancelled", "browser_dismissed"];
export type AuthOAuthTransportCancellationReason = (typeof AUTH_OAUTH_TRANSPORT_CANCELLATION_REASONS)[number];
export declare const AUTH_OAUTH_CANCELLATION_REASONS: readonly ["user_cancelled", "browser_dismissed", "provider_denied"];
export type AuthOAuthCancellationReason = (typeof AUTH_OAUTH_CANCELLATION_REASONS)[number];
export declare const AUTH_OAUTH_TRANSPORT_ERROR_CODES: readonly ["browser_unavailable", "transport_failed"];
export type AuthOAuthTransportErrorCode = (typeof AUTH_OAUTH_TRANSPORT_ERROR_CODES)[number];
export interface AuthOAuthTransportError {
    code: AuthOAuthTransportErrorCode;
    message: string;
    cause?: unknown;
}
export interface StartOAuthAuthorizationInput {
    provider: AuthOAuthProviderId;
    redirectUri: string;
    scopes?: readonly string[];
    queryParams?: ValueMap<string, string>;
}
export interface AuthOAuthAuthorizationRequest {
    attemptId: string;
    provider: AuthOAuthProviderId;
    authorizationUrl: string;
    redirectUri: string;
}
export type AuthOAuthStartResult = {
    ok: true;
    data: AuthOAuthAuthorizationRequest;
} | {
    ok: false;
    error: AuthOAuthError;
};
export type AuthOAuthAuthorizationResponse = {
    type: 'callback';
    url: string;
} | {
    type: 'cancelled';
    reason: AuthOAuthTransportCancellationReason;
} | {
    type: 'error';
    error: AuthOAuthTransportError;
};
export interface CompleteOAuthAuthorizationInput {
    attemptId: string;
    response: AuthOAuthAuthorizationResponse;
}
export type AuthOAuthCompletionResult = {
    ok: true;
    status: 'authenticated';
    provider: AuthOAuthProviderId;
    session: AuthSession;
} | {
    ok: false;
    status: 'cancelled';
    provider: AuthOAuthProviderId;
    reason: AuthOAuthCancellationReason;
} | {
    ok: false;
    status: 'error';
    error: AuthOAuthError;
};
export interface AuthOAuthCapabilities {
    /** Enabled providers for which start and callback completion are operational. */
    providers: readonly [AuthOAuthProviderId, ...AuthOAuthProviderId[]];
}
export interface AuthOAuthAdapter {
    readonly capabilities: AuthOAuthCapabilities;
    startAuthorization(input: StartOAuthAuthorizationInput): Promise<AuthOAuthStartResult>;
    completeAuthorization(input: CompleteOAuthAuthorizationInput): Promise<AuthOAuthCompletionResult>;
}
export interface AuthAdapterCapabilities {
    signInIdentifiers: AuthIdentifierKind[];
    supportsSignUp: boolean;
    supportsPasswordReset: boolean;
    supportsOtp: boolean;
    supportsSessionRefresh: boolean;
}
export interface AuthAdapter {
    readonly capabilities?: AuthAdapterCapabilities;
    /**
     * Presence is the canonical OAuth capability signal. When present, both authorization start and
     * callback completion are mandatory and operational for every advertised provider.
     */
    readonly oauth?: AuthOAuthAdapter;
    signIn(input: SignInInput): Promise<AuthResult<AuthSession>>;
    signUp(input: SignUpInput): Promise<AuthResult<AuthSession | AuthUser>>;
    signOut(input?: SignOutInput): Promise<AuthResult>;
    getSession(): Promise<AuthResult<AuthSession | null>>;
    refreshSession?(): Promise<AuthResult<AuthSession | null>>;
    requestPasswordReset?(input: PasswordResetInput): Promise<AuthResult>;
    verifyOtp?(input: VerifyOtpInput): Promise<AuthResult<AuthSession>>;
}
//# sourceMappingURL=auth.d.ts.map