import { type Type } from 'arktype';
import { type Maybe } from '@dereekb/util';
import { type InferredTargetModelParams } from '../../common/model/model/model.param';
import { type FirebaseFunctionTypeConfigMap, type ModelFirebaseCreateFunction, type ModelFirebaseCrudFunction, type ModelFirebaseCrudFunctionConfigMap, type ModelFirebaseFunctionMap } from '../../client';
import { type UserExternalConnectionTypes } from './userexternalconnection';
import { type UserExternalConnectionProviderType } from './userexternalconnection.id';
/**
 * Parameters for creating the calling user's connection document.
 *
 * Deliberately empty: the document is keyed by uid, so there is nothing to target and nothing to
 * seed it with — providers arrive one at a time through the OAuth flow, never at creation.
 *
 * @dbxModelApiParams
 */
export interface CreateUserExternalConnectionParams {
}
export declare const createUserExternalConnectionParamsType: Type<CreateUserExternalConnectionParams>;
/**
 * Parameters for disconnecting the current user from a third-party provider.
 *
 * This is the ONLY write path a client has to the connection pair. There is deliberately no connect
 * or update params type here: connecting requires credentials, which only the server ever sees.
 *
 * If no target model is provided, the current user's connection document is assumed.
 *
 * @dbxModelApiParams
 */
export interface DisconnectUserExternalConnectionParams extends InferredTargetModelParams {
    /**
     * The provider type to disconnect from.
     */
    readonly providerType: UserExternalConnectionProviderType;
}
export declare const disconnectUserExternalConnectionParamsType: Type<DisconnectUserExternalConnectionParams>;
/**
 * Parameters for beginning an OAuth connect handoff for a provider.
 *
 * @dbxModelApiParams
 */
export interface ReadUserExternalConnectionAuthorizeStateParams extends InferredTargetModelParams {
    /**
     * The provider type to begin connecting to.
     */
    readonly providerType: UserExternalConnectionProviderType;
    /**
     * Which handoff the state begins. Defaults to `connect`.
     *
     * - `connect` — attach the provider as a DATA connection, with the data scopes.
     * - `link` — make the provider a LOGIN METHOD for the already-signed-in caller, with the sign-in
     *   scopes. A separate round trip because the two scope sets are not guaranteed to be the same,
     *   so a data grant cannot be assumed to cover an identity read.
     *
     * Absent means `connect`, so a client minting a state before `link` existed still gets one.
     */
    readonly mode?: Maybe<'connect' | 'link'>;
}
export declare const readUserExternalConnectionAuthorizeStateParamsType: Type<ReadUserExternalConnectionAuthorizeStateParams>;
/**
 * Parameters for removing a provider as a LOGIN METHOD for the current user.
 *
 * Distinct from {@link DisconnectUserExternalConnectionParams}, and strictly larger: a disconnect
 * drops the data connection and leaves the login link in place, whereas an unlink removes the login
 * link AND the data connection and its credentials. "Stop using my Discord token" and "Discord is no
 * longer how I log in" are different requests, so they are different calls.
 *
 * If no target model is provided, the current user's connection document is assumed.
 *
 * @dbxModelApiParams
 */
export interface UnlinkUserExternalConnectionLoginParams extends InferredTargetModelParams {
    /**
     * The provider type to unlink.
     */
    readonly providerType: UserExternalConnectionProviderType;
}
export declare const unlinkUserExternalConnectionLoginParamsType: Type<UnlinkUserExternalConnectionLoginParams>;
/**
 * The opaque, short-lived `state` to carry through a provider's OAuth handoff.
 *
 * Minting it requires an authenticated call, because a top-level navigation to the provider's
 * authorize endpoint carries no credentials and the server must already know who is connecting. The
 * client's only job is to pass this through — it must never append its ID token to the redirect.
 */
export interface UserExternalConnectionAuthorizeStateResult {
    /**
     * The state to send on the authorize request.
     */
    readonly state: string;
}
/**
 * Custom (non-CRUD) function type map for UserExternalConnection. There are none.
 */
export type UserExternalConnectionFunctionTypeMap = {};
export declare const USER_EXTERNAL_CONNECTION_FUNCTION_TYPE_CONFIG_MAP: FirebaseFunctionTypeConfigMap<UserExternalConnectionFunctionTypeMap>;
/**
 * CRUD function configuration map for the UserExternalConnection model.
 */
export type UserExternalConnectionModelCrudFunctionsConfig = {
    readonly userExternalConnection: {
        /**
         * Creates the calling user's connection document.
         *
         * Every other client-reachable operation asserts a role against this document, so it must exist
         * before a user can begin a connect. Creating it is its own call — rather than a side effect of
         * the first connect — so that "may this user have external connections at all?" is decided in
         * one place instead of being folded into the OAuth handoff.
         *
         * Throws when the document already exists.
         */
        create: CreateUserExternalConnectionParams;
        read: {
            /**
             * Mints the short-lived `state` that begins an OAuth connect handoff for a provider.
             *
             * A read rather than an update: it changes nothing, it just proves who is asking. The app
             * decides how the state is signed and how long it lives.
             */
            authorizeState: [ReadUserExternalConnectionAuthorizeStateParams, UserExternalConnectionAuthorizeStateResult];
        };
        update: {
            /**
             * Disconnects the current user from the given provider.
             *
             * Removes the provider's credentials and its entry in one transaction, and recomputes the
             * connected-provider array from the result. The provider's LOGIN LINK is retained — a data
             * connection ending says nothing about whether the provider is still a way to sign in.
             */
            disconnect: DisconnectUserExternalConnectionParams;
            /**
             * Removes the given provider as a login method for the current user.
             *
             * Removes the login link, the entry, and the credentials in one transaction. Refused when it
             * would leave the account with no way to sign back in.
             */
            unlink: UnlinkUserExternalConnectionLoginParams;
        };
    };
};
export declare const USER_EXTERNAL_CONNECTION_MODEL_CRUD_FUNCTIONS_CONFIG: ModelFirebaseCrudFunctionConfigMap<UserExternalConnectionModelCrudFunctionsConfig, UserExternalConnectionTypes>;
/**
 * Abstract class defining all callable UserExternalConnection cloud functions.
 *
 * Implement this in your app module to wire up the function endpoints.
 */
export declare abstract class UserExternalConnectionFunctions implements ModelFirebaseFunctionMap<UserExternalConnectionFunctionTypeMap, UserExternalConnectionModelCrudFunctionsConfig> {
    abstract userExternalConnection: {
        createUserExternalConnection: ModelFirebaseCreateFunction<CreateUserExternalConnectionParams>;
        readUserExternalConnection: {
            authorizeState: ModelFirebaseCrudFunction<ReadUserExternalConnectionAuthorizeStateParams, UserExternalConnectionAuthorizeStateResult>;
        };
        updateUserExternalConnection: {
            disconnect: ModelFirebaseCrudFunction<DisconnectUserExternalConnectionParams>;
            unlink: ModelFirebaseCrudFunction<UnlinkUserExternalConnectionLoginParams>;
        };
    };
}
/**
 * Used to generate the UserExternalConnectionFunctions map for a Functions instance.
 */
export declare const userExternalConnectionFunctionMap: import("../..").ModelFirebaseFunctionMapFactory<UserExternalConnectionFunctionTypeMap, UserExternalConnectionModelCrudFunctionsConfig>;