import { Auth, type AuthAccessToken, type AuthAccessTokenGrant, type AuthStorageDescription, type AuthChallengeGrant, type AuthIdentity, type AuthImpersonationGrant, type AuthRequestMetadata, type AuthSessionGrant, type AuthSession, type Disposes, type LifecycleContext, Instant, type IssueAccessTokenInput, type LoginInput, type RegistrationInput, type ResolvedHttpAuthentication, type ExecutionContext, type ActorRef, type AuthenticationContext, type PolicyDecision, type Starts } from '@doxajs/core';
import type { CompiledAuthenticationConfiguration, CompiledCredentialReader } from './compiled-auth.js';
export interface PostgresAuthOptions {
    readonly connectionString: string;
    readonly trustedOrigins: readonly string[];
    readonly secureCookies: boolean;
    readonly absoluteSessionSeconds?: number;
    readonly idleSessionSeconds?: number;
    readonly applicationName?: string;
    readonly passwordCompromised?: (password: string) => boolean | Promise<boolean>;
    readonly challengeSeconds?: number;
    readonly sessionRenewalSeconds?: number;
    readonly sessionRotationGraceSeconds?: number;
    readonly impersonationSessionSeconds?: number;
    readonly identityId?: () => string;
    readonly tables?: {
        readonly identities: AuthIdentityTableMapping;
        readonly passwords: AuthPasswordTableMapping;
    };
}
export interface AuthIdentityTableMapping {
    readonly table: string;
    readonly id: string;
    readonly email: string;
    readonly contactEmail?: string;
    readonly emailVerifiedAt?: string;
    readonly createdAt: string;
    readonly updatedAt: string;
    readonly identifierKind?: 'email' | 'username' | 'custom';
    readonly normalization?: CompiledAuthenticationConfiguration['identifier']['normalization'];
    readonly verificationMode?: 'mapped' | 'trusted' | 'unsupported';
    readonly eligibility?: CompiledAuthenticationConfiguration['eligibility'];
}
export interface AuthPasswordTableMapping {
    readonly table: string;
    readonly identityId: string;
    /** The authoritative external credential column. */
    readonly password: string;
    readonly readers: readonly CompiledCredentialReader[];
    readonly mode?: 'managed' | 'login-only';
    readonly upgrade?: {
        readonly mode: 'never';
    } | {
        readonly mode: 'in-place';
        readonly format: 'doxa-argon2id';
        readonly updatedAt?: string;
    };
}
export interface ManagedIdentityRegistrationRequest {
    readonly id: string;
    readonly identifier: string;
    readonly contactEmail?: string;
    readonly createdAt: Instant;
    readonly updatedAt: Instant;
    readonly persistAuthentication: (transaction: unknown, identityId: string) => Promise<void>;
}
export interface CompiledAuthenticationRuntimeBinding {
    readonly registerManagedIdentity?: (request: ManagedIdentityRegistrationRequest) => Promise<string>;
}
export declare class PostgresAuth extends Auth implements Starts, Disposes {
    #private;
    private readonly options;
    static readonly id = "auth";
    constructor(options: PostgresAuthOptions);
    bindCompiledAuthentication(configuration: CompiledAuthenticationConfiguration, runtime?: CompiledAuthenticationRuntimeBinding): void;
    storage(): AuthStorageDescription;
    start(context: LifecycleContext): Promise<void>;
    dispose(_context: LifecycleContext): Promise<void>;
    register(input: RegistrationInput): Promise<AuthIdentity>;
    findIdentity(identityId: string): Promise<AuthIdentity | undefined>;
    login(input: LoginInput, metadata?: AuthRequestMetadata): Promise<AuthSessionGrant>;
    issueEmailVerification(identityId: string): Promise<AuthChallengeGrant>;
    verifyEmail(token: string): Promise<AuthIdentity>;
    issuePasswordReset(identifierInput: string, metadata?: AuthRequestMetadata): Promise<AuthChallengeGrant | undefined>;
    resetPassword(token: string, newPassword: string): Promise<void>;
    changePassword(identityId: string, currentPassword: string, newPassword: string): Promise<void>;
    reauthenticate(identityId: string, sessionId: string, password: string, metadata?: AuthRequestMetadata): Promise<Instant>;
    startImpersonation(identityId: string, sessionId: string, targetIdentityId: string, reason: string): Promise<AuthImpersonationGrant>;
    stopImpersonation(identityId: string, sessionId: string, impersonationGrantId: string): Promise<AuthSessionGrant>;
    validateAuthentication(actor: ActorRef, authentication: AuthenticationContext): Promise<boolean>;
    revokeSession(sessionId: string): Promise<void>;
    listSessions(identityId: string): Promise<readonly AuthSession[]>;
    revokeAllSessions(identityId: string): Promise<number>;
    issueAccessToken(identityId: string, input: IssueAccessTokenInput): Promise<AuthAccessTokenGrant>;
    listAccessTokens(identityId: string): Promise<readonly AuthAccessToken[]>;
    rotateAccessToken(identityId: string, tokenId: string): Promise<AuthAccessTokenGrant>;
    revokeAccessToken(identityId: string, tokenId: string): Promise<void>;
    recordAuthorization(ability: string, decision: PolicyDecision, context: ExecutionContext): Promise<void>;
    resolveHttp(request: Request): Promise<ResolvedHttpAuthentication>;
    sessionCookie(grant: AuthSessionGrant): string;
    expiredSessionCookie(): string;
}
//# sourceMappingURL=postgres-auth.d.ts.map