import { SecretValue as SecretValue$1 } from "../secrets/secret-value.js";
import { TokenEnvironment } from "./token-format.js";
import { AuthTokenRecord, AuthTokenStore } from "@graphorin/core/contracts";

//#region src/auth/crud.d.ts

/**
 * Options for `createToken(...)`.
 *
 * @stable
 */
interface CreateTokenOptions {
  readonly tokenStore: AuthTokenStore;
  readonly pepper: SecretValue$1;
  readonly env: TokenEnvironment | string;
  readonly scopes: ReadonlyArray<string>;
  readonly label?: string;
  readonly prefix?: string;
  /** Optional millisecond-precision expiry. Mutually exclusive with `expiresAt`. */
  readonly expiresInMs?: number;
  /** Optional explicit expiry as a Date or epoch ms. */
  readonly expiresAt?: Date | number;
  /** Optional id override (used by `rotateToken`); defaults to a random UUID. */
  readonly idOverride?: string;
  /** Wall-clock provider for tests. Defaults to `Date.now`. */
  readonly now?: () => number;
}
/**
 * Result of `createToken(...)`. The raw token is a `SecretValue` so it
 * is never accidentally logged on the way back to the caller.
 *
 * @stable
 */
interface CreatedToken {
  readonly raw: SecretValue$1;
  readonly record: AuthTokenRecord;
}
/**
 * Mint a new token, persist its HMAC hash through the injected store,
 * and return the raw token wrapped in a `SecretValue`. The plaintext
 * value is shown to the user exactly once - at the call site of this
 * function.
 *
 * @stable
 */
declare function createToken(options: CreateTokenOptions): Promise<CreatedToken>;
/**
 * List token metadata. Never returns the raw token or the HMAC hash;
 * the hash is hex on-disk only and would otherwise be a small offline
 * brute-force vector if both the database **and** the pepper were
 * compromised.
 *
 * @stable
 */
declare function listTokens(tokenStore: AuthTokenStore, opts?: {
  readonly includeRevoked?: boolean;
}): Promise<ReadonlyArray<TokenMetadata>>;
/**
 * Soft-revoke a token. Returns the updated record or `undefined` if
 * the token is unknown. The store is responsible for setting the
 * `revokedAt` column atomically.
 *
 * @stable
 */
declare function revokeToken(tokenStore: AuthTokenStore, id: string, opts?: {
  readonly now?: () => number;
  /**
   * Pass the live `TokenVerifier` so revocation invalidates its
   * LRU entry immediately - without it a revoked token keeps verifying
   * from the cache for up to `cacheTtlMaxMs` (default 60s).
   */
  readonly verifier?: {
    invalidate(rawTokenOrHashHex: string): void;
  };
}): Promise<TokenMetadata | undefined>;
/**
 * Revoke a token and immediately mint a fresh one with the same
 * scopes. Useful for grace-period rotations.
 *
 * @stable
 */
declare function rotateToken(options: Omit<CreateTokenOptions, 'scopes' | 'env' | 'idOverride'> & {
  readonly id: string;
  readonly env?: TokenEnvironment | string;
  readonly scopesOverride?: ReadonlyArray<string>;
  /** Invalidates the rotated-out token's verifier cache entry. */
  readonly verifier?: {
    invalidate(rawTokenOrHashHex: string): void;
  };
}): Promise<{
  readonly old: TokenMetadata;
  readonly next: CreatedToken;
}>;
/**
 * Re-issue every active token. Used after a known compromise: the
 * previous tokens are revoked and replaced with fresh raw values
 * using the same scopes / labels.
 *
 * Returns the new tokens keyed by their old id so the caller can
 * route the rotated raws back to the right user.
 *
 * @stable
 */
declare function rekeyTokens(options: {
  readonly tokenStore: AuthTokenStore;
  readonly pepper: SecretValue$1;
  readonly env: TokenEnvironment | string;
  readonly prefix?: string;
  readonly now?: () => number;
}): Promise<ReadonlyMap<string, CreatedToken>>;
/**
 * Generate a fresh server pepper. The result is always exactly 32
 * bytes (256 bits) so the verifier can rely on the size invariant.
 *
 * @stable
 */
declare function generatePepper(): SecretValue$1;
/**
 * Public-safe metadata view of a token. The HMAC hash and pepper are
 * never surfaced.
 *
 * @stable
 */
interface TokenMetadata {
  readonly id: string;
  readonly label?: string;
  readonly scopes: ReadonlyArray<string>;
  readonly createdAt: string;
  readonly expiresAt?: string;
  readonly revokedAt?: string;
  readonly lastUsedAt?: string;
}
//#endregion
export { CreateTokenOptions, CreatedToken, TokenMetadata, createToken, generatePepper, listTokens, rekeyTokens, revokeToken, rotateToken };
//# sourceMappingURL=crud.d.ts.map