/**
 * This Source Code is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * Copyright (c) Infonomic Company Limited
 */
import { type AdminAuth, type RefreshSessionArgs, type RevokeSessionArgs, type SessionProvider, type SessionProviderCapabilities, type SessionTokens, type SignInResult, type SignInWithPasswordArgs } from '@byline/auth';
import type { AdminStore } from '../../store.js';
export interface NativeSessionEvent {
    type: 'refresh_attempted' | 'refresh_completed' | 'refresh_contested';
}
export interface JwtSessionProviderConfig {
    /** Best-effort, token-free renewal telemetry. Errors never change authentication outcomes. */
    onEvent?: (event: NativeSessionEvent) => void;
    /**
     * Adapter-backed admin repositories. Construct via the DB adapter's
     * admin-store factory (e.g. `createAdminStore(db)` from
     * `@byline/db-postgres/admin`) and pass the result in — the provider
     * does not touch Drizzle or any other adapter-specific API directly.
     */
    store: AdminStore;
    /**
     * HMAC-SHA256 signing secret. Must be at least 32 bytes (256 bits) of
     * entropy. Load from a secret manager — never hard-code.
     *
     * To switch to asymmetric signing (RS256/EdDSA), swap out this provider
     * for a custom one backed by `jose` key objects.
     */
    signingSecret: string | Uint8Array;
    /** Issuer claim (`iss`) on access tokens. Defaults to `'byline'`. */
    issuer?: string;
    /** Access-token lifetime in seconds. Default 15 min. */
    accessTokenTtlSeconds?: number;
    /** Refresh-token lifetime in seconds. Default 30 days. */
    refreshTokenTtlSeconds?: number;
    /** Clock reference — override for deterministic tests. */
    now?: () => Date;
}
export declare class JwtSessionProvider implements SessionProvider {
    #private;
    readonly capabilities: SessionProviderCapabilities;
    constructor(config: JwtSessionProviderConfig);
    signInWithPassword(args: SignInWithPasswordArgs): Promise<SignInResult>;
    verifyAccessToken(token: string): Promise<{
        actor: AdminAuth;
        sessionId: string;
    }>;
    refreshSession(args: RefreshSessionArgs): Promise<SessionTokens>;
    revokeSession(args: RevokeSessionArgs): Promise<void>;
    resolveActor(adminUserId: string): Promise<AdminAuth | null>;
}