import { VerifiedOpenId4VcCredentialHolderBinding } from "../../shared/models/CredentialHolderBinding.mjs";
import { OpenId4VciCredentialOfferPayload } from "../../shared/models/index.mjs";
import { OpenId4VcIssuanceSessionState } from "../OpenId4VcIssuanceSessionState.mjs";
import "../../shared/index.mjs";
import { OpenId4VciVersion } from "../OpenId4VcIssuerServiceOptions.mjs";
import { BaseRecord, RecordTags, TagsBase } from "@credo-ts/core";
import { AccessTokenResponse, AuthorizationServerMetadata, PkceCodeChallengeMethod } from "@openid4vc/oauth2";

//#region src/openid4vc-issuer/repository/OpenId4VcIssuanceSessionRecord.d.ts
interface OpenId4VcIssuanceSessionDpop {
  /**
   * Whether dpop is required. Can be set to false to override the
   * global config
   */
  required: boolean;
  /**
   * JWK thumbprint of the dpop key. This is mostly used when a dpop key is bound
   * to the issuance session before the access token is created (which contains the dpop key)
   */
  dpopJkt?: string;
}
interface OpenId4VcIssuanceSessionWalletAttestation {
  /**
   * Whether presentation of a wallet attestation is required.
   * Can be set to false to override the global config
   */
  required: boolean;
}
interface OpenId4VcIssuanceSessionAuthorization {
  code?: string;
  /**
   * @todo: I saw in google's library that for codes they encrypt an id with expiration time.
   * You know the code was created by you because you can decrypt it, and you don't have to store
   * additional metadata on your server. It's similar to the signed / encrypted nonce
   */
  codeExpiresAt?: Date;
  /**
   * String value created by the Credential Issuer and opaque to the Wallet that
   * is used to bind the subsequent Authorization Request with the Credential Issuer to a context set up during previous steps.
   */
  issuerState?: string;
  /**
   * Scopes that are granted when the authorization is complete.
   */
  scopes?: string[];
  /**
   * Subject the issuance session is bound to. For internal authorization this will be defined
   * from the moment the token is issued. For external authorization this will be defined after
   * the first time the credential endpoint has been called.
   */
  subject?: string;
}
interface OpenId4VcIssuanceSessionPresentation {
  /**
   * Whether presentation during issuance is required. Mutually exclusive with `chainedIdentity`.
   */
  required: true;
  /**
   * Auth session for the presentation during issuance flow
   */
  authSession?: string;
  /**
   * The id of the `OpenId4VcVerificationSessionRecord` record this issuance session is linked to
   */
  openId4VcVerificationSessionId?: string;
}
interface OpenId4VcIssuanceSessionPkce {
  codeChallengeMethod: PkceCodeChallengeMethod;
  codeChallenge: string;
}
interface OpenId4VcIssuanceSessionChainedIdentity {
  /**
   * The identifier of the external identity provider's authorization server.
   * Mutually exclusive with `presentation`.
   */
  externalAuthorizationServerUrl: string;
  /**
   * The <reference-value> from the `request_uri` parameter returned to the client
   * in the form of `urn:ietf:params:oauth:request_uri:<reference-value>`.
   */
  requestUriReferenceValue?: string;
  /**
   * The expiry time of the request URI.
   *
   * @todo: I saw in google's library that for codes they encrypt an id with expiration time.
   * You know the code was created by you because you can decrypt it, and you don't have to store
   * additional metadata on your server. It's similar to the signed / encrypted nonce
   */
  requestUriExpiresAt?: Date;
  /**
   * The state value that was received in the pushed authorization request.
   */
  state?: string;
  /**
   * The redirect uri to redirect to after the authorization code has been granted.
   */
  redirectUri?: string;
  /**
   * The PKCE code verifier used in the authorization request to the external identity provider.
   */
  pkceCodeVerifier?: string;
  /**
   * The chained identity authorization request url, used to authorize to the external identity provider.
   */
  externalAuthorizationRequestUrl?: string;
  /**
   * The state value used in the authorization request to the external identity provider.
   */
  externalState?: string;
  /**
   * The metadata of the external identity provider's authorization server.
   */
  externalAuthorizationServerMetadata?: AuthorizationServerMetadata;
  /**
   * The access token response received from the external identity provider.
   *
   * If the scope 'openid' is requested, we automatically verify if the
   * ID Token JWT is valid.
   */
  externalAccessTokenResponse?: AccessTokenResponse;
}
type DefaultOpenId4VcIssuanceSessionRecordTags = {
  issuerId: string;
  cNonce?: string;
  state: OpenId4VcIssuanceSessionState;
  credentialOfferUri?: string;
  credentialOfferId?: string;
  preAuthorizedCode?: string;
  authorizationCode?: string;
  issuerState?: string;
  authorizationSubject?: string;
  presentationAuthSession?: string;
  chainedIdentityRequestUriReferenceValue?: string;
  chainedIdentityState?: string;
};
interface OpenId4VcIssuanceSessionRecordTransaction {
  transactionId: string;
  numberOfCredentials: number;
  credentialConfigurationId: string;
  /**
   * The holder binding that should be used for the credentials in this
   * transaction.
   *
   * @since 0.6.3
   */
  holderBinding?: VerifiedOpenId4VcCredentialHolderBinding;
  /**
   * The time until which this transaction is deferred. This is based on
   * the previously returned interval.
   *
   * @since 0.6.3
   */
  deferredUntil?: Date;
}
interface OpenId4VcIssuanceSessionRecordProps {
  createdAt: Date;
  expiresAt: Date;
  id?: string;
  tags?: TagsBase;
  state: OpenId4VcIssuanceSessionState;
  issuerId: string;
  /**
   * Client id will mostly be used when doing auth flow
   */
  clientId?: string;
  walletAttestation?: OpenId4VcIssuanceSessionWalletAttestation;
  dpop?: OpenId4VcIssuanceSessionDpop;
  preAuthorizedCode?: string;
  userPin?: string;
  pkce?: {
    codeChallengeMethod: PkceCodeChallengeMethod;
    codeChallenge: string;
  };
  /**
   * When authorization code flow is used, this links the authorization
   */
  authorization?: OpenId4VcIssuanceSessionAuthorization;
  /**
   * When presentation during issuance is required this should link the
   * `OpenId4VcVerificationSessionRecord` and state
   */
  presentation?: OpenId4VcIssuanceSessionPresentation;
  transactions?: OpenId4VcIssuanceSessionRecordTransaction[];
  /**
   * Identity chaining enables doing another OAuth2 authentication flow as part
   * of the OpenID4VCI authorization flow. This allows leveraging the advanced OAuth2
   * functionality from Credo (e.g. Wallet Attestations, DPoP, PAR) while still allowing
   * integration with existing IDPs.
   */
  chainedIdentity?: OpenId4VcIssuanceSessionChainedIdentity;
  credentialOfferUri?: string;
  credentialOfferId: string;
  credentialOfferPayload: OpenId4VciCredentialOfferPayload;
  issuanceMetadata?: Record<string, unknown>;
  errorMessage?: string;
  generateRefreshTokens?: boolean;
  /**
   * The version of openid4ci used for the request
   */
  openId4VciVersion: OpenId4VciVersion;
}
declare class OpenId4VcIssuanceSessionRecord extends BaseRecord<DefaultOpenId4VcIssuanceSessionRecordTags> {
  static readonly type = "OpenId4VcIssuanceSessionRecord";
  readonly type = "OpenId4VcIssuanceSessionRecord";
  /**
   * Expiry time for the issuance session. This can change dynamically during
   * the session lifetime, based on the possible deferrals.
   *
   * @since 0.6
   */
  expiresAt?: Date;
  /**
   * The id of the issuer that this session is for.
   */
  issuerId: string;
  /**
   * The state of the issuance session.
   */
  state: OpenId4VcIssuanceSessionState;
  /**
   * The credentials that were issued during this session.
   */
  issuedCredentials: string[];
  /**
   * The credential transactions for deferred credentials.
   */
  transactions: OpenId4VcIssuanceSessionRecordTransaction[];
  /**
   * Pre authorized code used for the issuance session. Only used when a pre-authorized credential
   * offer is created.
   */
  preAuthorizedCode?: string;
  /**
   * Optional user pin that needs to be provided by the user in the access token request.
   */
  userPin?: string;
  /**
   * Client id of the exchange
   */
  clientId?: string;
  /**
   * Proof Key Code Exchange
   */
  pkce?: OpenId4VcIssuanceSessionPkce;
  walletAttestation?: OpenId4VcIssuanceSessionWalletAttestation;
  dpop?: OpenId4VcIssuanceSessionDpop;
  /**
   * Authorization code flow specific metadata values
   */
  authorization?: OpenId4VcIssuanceSessionAuthorization;
  /**
   * Presentation during issuance specific metadata values
   */
  presentation?: OpenId4VcIssuanceSessionPresentation;
  /**
   * Chained identity specific metadata values
   */
  chainedIdentity?: OpenId4VcIssuanceSessionChainedIdentity;
  /**
   * User-defined metadata that will be provided to the credential request to credential mapper
   * to allow to retrieve the needed credential input data. Can be the credential data itself,
   * or some other data that is needed to retrieve the credential data.
   */
  issuanceMetadata?: Record<string, unknown>;
  /**
   * The credential offer that was used to create the issuance session.
   */
  credentialOfferPayload: OpenId4VciCredentialOfferPayload;
  /**
   * URI of the credential offer. This is the url that cn can be used to retrieve
   * the credential offer
   */
  credentialOfferUri?: string;
  /**
   * The public id for the credential offer. This is used in the credential
   * offer uri.
   *
   * @since 0.6
   */
  credentialOfferId?: string;
  /**
   * Whether to generate refresh tokens for the issuance session.
   *
   * @since 0.6
   */
  generateRefreshTokens?: boolean;
  /**
   * The version of openid4ci used for the request
   *
   * @since 0.6
   */
  openId4VciVersion?: OpenId4VciVersion;
  /**
   * Optional error message of the error that occurred during the issuance session. Will be set when state is {@link OpenId4VcIssuanceSessionState.Error}
   */
  errorMessage?: string;
  constructor(props: OpenId4VcIssuanceSessionRecordProps);
  assertState(expectedStates: OpenId4VcIssuanceSessionState | OpenId4VcIssuanceSessionState[]): void;
  getTags(): {
    issuerId: string;
    credentialOfferUri: string | undefined;
    credentialOfferId: string | undefined;
    state: OpenId4VcIssuanceSessionState;
    preAuthorizedCode: string | undefined;
    issuerState: string | undefined;
    authorizationCode: string | undefined;
    authorizationSubject: string | undefined;
    presentationAuthSession: string | undefined;
    chainedIdentityRequestUriReferenceValue: string | undefined;
    chainedIdentityState: string | undefined;
  };
}
//#endregion
export { DefaultOpenId4VcIssuanceSessionRecordTags, OpenId4VcIssuanceSessionAuthorization, OpenId4VcIssuanceSessionChainedIdentity, OpenId4VcIssuanceSessionDpop, OpenId4VcIssuanceSessionPkce, OpenId4VcIssuanceSessionPresentation, OpenId4VcIssuanceSessionRecord, OpenId4VcIssuanceSessionRecordProps, OpenId4VcIssuanceSessionRecordTransaction, OpenId4VcIssuanceSessionWalletAttestation };
//# sourceMappingURL=OpenId4VcIssuanceSessionRecord.d.mts.map