/**
 * SessionProvider — kontrakt wymiennej warstwy sesji.
 *
 * Framework NIE narzuca protokołu. Projekt implementuje własny provider
 * lub wybiera opt-in adapter (@echelon-framework/session-oidc, session-cookie, etc.).
 *
 * Wspólne mechanizmy (IdleMonitor, RefreshScheduler, multi-tab coordination,
 * step-up auth) żyją w @echelon-framework/security-core i używają tego kontraktu.
 */
import type { Observable } from 'rxjs';
import type { SessionId } from '../identity/index.js';
export type SessionLevel = 'anonymous' | 'basic' | 'elevated' | 'admin';
export interface SessionSubject {
    readonly userId: string;
    readonly dealerId?: string;
    readonly actingFor?: string;
}
export interface SessionSnapshot {
    readonly id: SessionId;
    readonly subject: SessionSubject;
    readonly level: SessionLevel;
    readonly issuedAt: number;
    readonly expiresAt: number;
    readonly claims: ReadonlyMap<string, unknown>;
    readonly fingerprint: string;
}
export type SessionState = {
    readonly kind: 'unauthenticated';
} | {
    readonly kind: 'authenticating';
} | {
    readonly kind: 'authenticated';
    readonly snapshot: SessionSnapshot;
} | {
    readonly kind: 'refreshing';
    readonly snapshot: SessionSnapshot;
} | {
    readonly kind: 'degraded';
    readonly snapshot: SessionSnapshot;
    readonly reason: string;
} | {
    readonly kind: 'revoked';
    readonly reason: RevocationReason;
};
export type RevocationReason = 'user-logout' | 'idle-timeout' | 'server-revoked' | 'concurrent-session' | 'step-up-failed' | 'session-expired' | 'context-switch' | 'error';
export type StepUpLevel = 'elevated' | 'admin';
export interface OutboundRequest {
    readonly headers: Record<string, string>;
    readonly [key: string]: unknown;
}
export interface InboundResponse {
    readonly status: number;
    readonly headers: Record<string, string>;
}
export interface SessionProvider {
    readonly session$: Observable<SessionState>;
    current(): SessionSnapshot | null;
    acquire(credentials?: unknown): Promise<SessionSnapshot>;
    refresh(): Promise<SessionSnapshot>;
    revoke(reason: RevocationReason): Promise<void>;
    elevate(level: StepUpLevel): Promise<SessionSnapshot>;
    /**
     * Dealer zmienia klienta w imieniu którego działa.
     * To nie jest step-up — to osobna operacja z reweryfikacją mandatu i compliance.
     */
    switchContext(actingFor: string): Promise<SessionSnapshot>;
    /** Provider dodaje auth do outbound request (cookie: no-op + CSRF; JWT: Authorization). */
    attach(request: OutboundRequest): OutboundRequest;
    /** Detekcja server-side invalidation (401, X-Session-Revoked header). */
    verify(response: InboundResponse): void;
}
export declare const SESSION_PROVIDER: import("../index.js").EchelonToken<SessionProvider>;
//# sourceMappingURL=index.d.ts.map