import * as hono_hono_base from 'hono/hono-base';
import * as hono_types from 'hono/types';
import * as hono_aws_lambda from 'hono/aws-lambda';
import * as hono from 'hono';
import { Provider } from './provider/provider.js';
import { SubjectSchema, SubjectPayload } from './subject.js';
import { UnknownStateError } from './error.js';
import { StorageAdapter } from './storage/storage.js';
import { Theme } from './ui/theme.js';
import '@standard-schema/spec';
import './util.js';

/**
 * Sets the subject payload in the JWT token and returns the response.
 *
 * ```ts
 * ctx.subject("user", {
 *   userID
 * })
 * ```
 */
interface OnSuccessResponder<T extends {
    type: string;
    properties: any;
}> {
    /**
     * The `type` is the type of the subject, that was defined in the `subjects` field.
     *
     * The `properties` are the properties of the subject. This is the shape of the subject that
     * you defined in the `subjects` field.
     */
    subject<Type extends T["type"]>(type: Type, properties: Extract<T, {
        type: Type;
    }>["properties"], opts?: {
        ttl?: {
            access?: number;
            refresh?: number;
        };
        subject?: string;
    }): Promise<Response>;
}
/**
 * @internal
 */
interface AuthorizationState {
    redirect_uri: string;
    response_type: string;
    state: string;
    client_id: string;
    audience?: string;
    pkce?: {
        challenge: string;
        method: "S256";
    };
}
/**
 * @internal
 */
type Prettify<T> = {
    [K in keyof T]: T[K];
} & {};

/** @internal */
declare const aws: <E extends hono.Env = hono.Env, S extends hono.Schema = {}, BasePath extends string = "/">(app: hono.Hono<E, S, BasePath>) => (<L extends hono_aws_lambda.LambdaEvent>(event: L, lambdaContext?: hono_aws_lambda.LambdaContext) => Promise<hono_aws_lambda.APIGatewayProxyResult & (L extends {
    multiValueHeaders: Record<string, string[]>;
} ? {
    headers?: undefined;
    multiValueHeaders: Record<string, string[]>;
} : {
    headers: Record<string, string>;
    multiValueHeaders?: undefined;
})>);
interface IssuerInput<Providers extends Record<string, Provider<any>>, Subjects extends SubjectSchema, Result = {
    [key in keyof Providers]: Prettify<{
        provider: key;
    } & (Providers[key] extends Provider<infer T> ? T : {})>;
}[keyof Providers]> {
    /**
     * The shape of the subjects that you want to return.
     *
     * @example
     *
     * ```ts title="issuer.ts"
     * import { object, string } from "valibot"
     * import { createSubjects } from "@aryalabs/openauth/subject"
     *
     * issuer({
     *   subjects: createSubjects({
     *     user: object({
     *       userID: string()
     *     })
     *   })
     *   // ...
     * })
     * ```
     */
    subjects: Subjects;
    /**
     * The storage adapter that you want to use.
     *
     * @example
     * ```ts title="issuer.ts"
     * import { DynamoStorage } from "@aryalabs/openauth/storage/dynamo"
     *
     * issuer({
     *   storage: DynamoStorage()
     *   // ...
     * })
     * ```
     */
    storage?: StorageAdapter;
    /**
     * The providers that you want your OpenAuth server to support.
     *
     * @example
     *
     * ```ts title="issuer.ts"
     * import { GithubProvider } from "@aryalabs/openauth/provider/github"
     *
     * issuer({
     *   providers: {
     *     github: GithubProvider()
     *   }
     * })
     * ```
     *
     * The key is just a string that you can use to identify the provider. It's passed back to
     * the `success` callback.
     *
     * You can also specify multiple providers.
     *
     * ```ts
     * {
     *   providers: {
     *     github: GithubProvider(),
     *     google: GoogleProvider()
     *   }
     * }
     * ```
     */
    providers: Providers;
    /**
     * The theme you want to use for the UI.
     *
     * This includes the UI the user sees when selecting a provider. And the `PasswordUI` and
     * `CodeUI` that are used by the `PasswordProvider` and `CodeProvider`.
     *
     * @example
     * ```ts title="issuer.ts"
     * import { THEME_SST } from "@aryalabs/openauth/ui/theme"
     *
     * issuer({
     *   theme: THEME_SST
     *   // ...
     * })
     * ```
     *
     * Or define your own.
     *
     * ```ts title="issuer.ts"
     * import type { Theme } from "@aryalabs/openauth/ui/theme"
     *
     * const MY_THEME: Theme = {
     *   // ...
     * }
     *
     * issuer({
     *   theme: MY_THEME
     *   // ...
     * })
     * ```
     */
    theme?: Theme;
    /**
     * Set the TTL, in seconds, for access and refresh tokens.
     *
     * @example
     * ```ts
     * {
     *   ttl: {
     *     access: 60 * 60 * 24 * 30,
     *     refresh: 60 * 60 * 24 * 365
     *   }
     * }
     * ```
     */
    ttl?: {
        /**
         * Interval in seconds where the access token is valid.
         * @default 30d
         */
        access?: number;
        /**
         * Interval in seconds where the refresh token is valid.
         * @default 1y
         */
        refresh?: number;
        /**
         * Interval in seconds where refresh token reuse is allowed. This helps mitigrate
         * concurrency issues.
         * @default 60s
         */
        reuse?: number;
        /**
         * Interval in seconds to retain refresh tokens for reuse detection.
         * @default 0s
         */
        retention?: number;
    };
    /**
     * Optionally, configure the UI that's displayed when the user visits the root URL of the
     * of the OpenAuth server.
     *
     * ```ts title="issuer.ts"
     * import { Select } from "@aryalabs/openauth/ui/select"
     *
     * issuer({
     *   select: Select({
     *     providers: {
     *       github: { hide: true },
     *       google: { display: "Google" }
     *     }
     *   })
     *   // ...
     * })
     * ```
     *
     * @default Select()
     */
    select?(providers: Record<string, string>, req: Request): Promise<Response>;
    /**
     * @internal
     */
    start?(req: Request): Promise<void>;
    /**
     * The success callback that's called when the user completes the flow.
     *
     * This is called after the user has been redirected back to your app after the OAuth flow.
     *
     * @example
     * ```ts
     * {
     *   success: async (ctx, value) => {
     *     let userID
     *     if (value.provider === "password") {
     *       console.log(value.email)
     *       userID = ... // lookup user or create them
     *     }
     *     if (value.provider === "github") {
     *       console.log(value.tokenset.access)
     *       userID = ... // lookup user or create them
     *     }
     *     return ctx.subject("user", {
     *       userID
     *     })
     *   },
     *   // ...
     * }
     * ```
     */
    success(response: OnSuccessResponder<SubjectPayload<Subjects>>, input: Result, req: Request): Promise<Response>;
    /**
     * @internal
     */
    error?(error: UnknownStateError, req: Request): Promise<Response>;
    /**
     * Override the logic for whether a client request is allowed to call the issuer.
     *
     * By default, it uses the following:
     *
     * - Allow if the `redirectURI` is localhost.
     * - Compare `redirectURI` to the request's hostname or the `x-forwarded-host` header. If they
     *   are from the same sub-domain level, then allow.
     *
     * @example
     * ```ts
     * {
     *   allow: async (input, req) => {
     *     // Allow all clients
     *     return true
     *   }
     * }
     * ```
     */
    allow?(input: {
        clientID: string;
        redirectURI: string;
        audience?: string;
    }, req: Request): Promise<boolean>;
}
/**
 * Create an OpenAuth server, a Hono app.
 */
declare function issuer<Providers extends Record<string, Provider<any>>, Subjects extends SubjectSchema, Result = {
    [key in keyof Providers]: Prettify<{
        provider: key;
    } & (Providers[key] extends Provider<infer T> ? T : {})>;
}[keyof Providers]>(input: IssuerInput<Providers, Subjects, Result>): hono_hono_base.HonoBase<{
    Variables: {
        authorization: AuthorizationState;
    };
}, hono_types.BlankSchema, "/">;

export { type AuthorizationState, type IssuerInput, type OnSuccessResponder, type Prettify, aws, issuer };