/**
 * Auth-UI Registry (#469 — slot→file map + name→handler map).
 *
 * Built per OAuth scope from the scope's resolved auth options:
 *  - `auth.ui` — a {@link AuthSlot} → relative `.tsx`/`.jsx` PATH map, and
 *  - `auth.extras` — an extra-name → server HANDLER function map.
 *
 * It resolves each slot's file against the scope's captured source directory
 * (the `@FrontMcp`/`@App` `__sourceDir`; absolute paths pass through) and owns
 * the cross-cutting SERVER-side concerns the client contract delegates to the
 * server:
 *  - CSRF minting + verifying (per pending-auth id),
 *  - the per-(pending-auth, extra) ACCUMULATOR that backs `useAddedItems(name)`,
 *  - the per-slot {@link AuthUiFileSource} the page builder transpiles.
 *
 * The auth pages render ENTIRELY in the browser from a server-side single-file
 * TRANSFORM routed through `@frontmcp/uipack`'s pluggable `renderComponent`: the
 * slot's `.tsx` is transpiled with esbuild `transformSync` (deps stay external)
 * and inlined as a `<script type="module">`, with react / react-dom /
 * `@frontmcp/ui/auth` loaded from esm.sh via an import-map. The server NEVER
 * imports, bundles, or evaluates the component — no IIFE bundle, no served `.js`.
 *
 * When NO file is registered for a slot, the flows fall back to the built-in
 * HTML pages unchanged (the no-config default). No PII is stored — the
 * accumulator holds whatever items the developer's extra handler accepted
 * (their responsibility), keyed by opaque pending-auth id.
 *
 * @packageDocumentation
 */
import { type AuthExtraHandler } from '@frontmcp/auth';
import { type FrontMcpLogger } from '../../common';
import { type AuthSlot, type AuthUiFileSource } from './auth-ui.contract';
/**
 * The JSON returned to the client from an extra submit. Mirrors the client
 * `AuthExtraResult` shape — `addedItems` here is the FULL accumulator MAP keyed
 * by extra name (not the handler's per-call new-items list).
 */
export interface AuthExtraRunResult {
    ok: boolean;
    error?: string;
    addedItems?: Record<string, unknown[]>;
    sideEffects?: Record<string, unknown>;
}
/**
 * Registry of custom auth-UI slot files + extra handlers for a scope.
 */
export declare class AuthUiRegistry {
    private readonly slots;
    private readonly extras;
    private readonly pending;
    private readonly logger?;
    /**
     * Optional per-specifier resolver overrides applied when building the page's
     * import-map (e.g. mapping `@frontmcp/ui/auth` to a locally-served ESM URL in
     * dev / offline, where it isn't on esm.sh).
     */
    private resolverOverrides?;
    constructor(logger?: FrontMcpLogger);
    /**
     * Register the `auth.ui` slot→file map. Each relative path is resolved against
     * `sourceDir` (the declaring `@FrontMcp`/`@App` directory); absolute paths pass
     * through. Later registrations for the same slot win (so a scope can override a
     * server-level default).
     */
    registerAuthUiMap(map: Partial<Record<AuthSlot, string>> | undefined, sourceDir: string): void;
    /**
     * Register the `auth.extras` name→handler map. Each value must be a function
     * `(input, ctx) => AuthExtraResult | Promise<AuthExtraResult>`.
     */
    registerAuthExtrasMap(map: Record<string, AuthExtraHandler> | undefined): void;
    /**
     * Set per-specifier import-map overrides for the page builder. Use in dev /
     * offline to point `@frontmcp/ui/auth` (not on esm.sh in a monorepo) at a
     * locally-served ESM URL.
     */
    setResolverOverrides(overrides: Record<string, string> | undefined): void;
    /** The configured import-map overrides (undefined when none). */
    getResolverOverrides(): Record<string, string> | undefined;
    /** Whether any custom slot file is registered. */
    hasAny(): boolean;
    /** Whether a custom file is registered for `slot`. */
    hasSlot(slot: AuthSlot): boolean;
    /** Whether any extra handler is registered. */
    hasExtras(): boolean;
    /**
     * The file-based source for a slot, or `undefined` when the slot is
     * unregistered or previously failed to build (error cached). Used by the page
     * builder to transpile the `.tsx` server-side.
     */
    getSlotSource(slot: AuthSlot): AuthUiFileSource | undefined;
    /**
     * Whether a slot can be rendered — i.e. a file is registered for it (and it
     * hasn't recorded a build error). Used by the page assembler to decide between
     * the custom page and the built-in fallback.
     */
    canRenderSlot(slot: AuthSlot): boolean;
    /**
     * Record a transform/build error for a slot so a broken file isn't
     * re-transpiled on every request (the slot then falls back to the built-in
     * page). Called by the page builder when the transform throws.
     */
    recordSlotError(slot: AuthSlot, message: string): void;
    /**
     * Mint (or reuse) the CSRF token for a pending-auth id and return it. The
     * token is stored server-side and echoed into {@link AuthFlowState.csrfToken}.
     */
    mintCsrf(pendingAuthId: string): string;
    /**
     * Look up a pending-ui entry, enforcing the TTL at read time: an expired entry
     * is deleted and treated as absent. This guarantees a stale token can never
     * validate even if no prune-triggering write happened after it expired.
     */
    private getActivePending;
    /**
     * Verify a submitted CSRF token against the minted one for this pending-auth.
     * Returns false on any mismatch / unknown / expired pending id (caller rejects 400).
     */
    verifyCsrf(pendingAuthId: string | undefined, submitted: string | undefined): boolean;
    /**
     * Current accumulators for a pending-auth id (empty when none yet). Returns a
     * DEEP copy — each array is cloned — so callers (e.g. an extra handler reading
     * `ctx.current`) can never mutate the internal accumulator by reference.
     */
    getAddedItems(pendingAuthId: string | undefined): Record<string, unknown[]>;
    /** Append accepted items to an extra's accumulator and return the full map. */
    appendItems(pendingAuthId: string, extraName: string, items: unknown[]): Record<string, unknown[]>;
    private ensurePending;
    private pruneExpired;
    /** Whether a handler is registered for `name`. */
    hasExtra(name: string): boolean;
    /**
     * Route an extra submission to its registered handler. Persists accepted items
     * into the per-pending-auth accumulator and returns the full result including
     * the updated `addedItems` map (so the client refreshes without a reload).
     * Returns `{ ok:false }` when no handler is registered for `name`.
     *
     * Note: the returned `addedItems` is the FULL accumulator MAP (keyed by extra
     * name) — the client `AuthExtraResult` shape — not the handler's per-call
     * `addedItems` (which is the list of NEW items).
     */
    runExtra(name: string, pendingAuthId: string | undefined, input: Record<string, unknown>): Promise<AuthExtraRunResult>;
    /**
     * Validate every registered slot's source at startup (mirroring tool-ui's
     * `compileUIWidgets`): a missing / non-`.tsx` file is caught lazily at first
     * render and cached as an error so the slot falls back to the built-in page
     * instead of failing the request. This is just a cheap preflight log; it never
     * throws — a broken component must not take the server down.
     */
    warmup(): Promise<void>;
}
//# sourceMappingURL=auth-ui.registry.d.ts.map