import { AuthorizeCodeOptions, AuthorizeDeviceOptions, CreateOAuthClientOptions, OAuthClient, OAuthSession, OAuthSessionMetadata, OAuthStrategy } from "./types.js";
import * as _graphorin_core_contracts1 from "@graphorin/core/contracts";
import { OAuthServerStore } from "@graphorin/core/contracts";

//#region src/oauth/library.d.ts

/**
 * Options accepted by {@link loginInteractive}.
 *
 * @stable
 */
interface LoginInteractiveOptions {
  /**
   * Secrets store the session tokens are persisted into so the
   * login survives the process.
   */
  readonly secretsStore?: _graphorin_core_contracts1.SecretsStore;
  readonly serverId: string;
  readonly serverUrl: string;
  readonly storage: OAuthServerStore;
  /** Default `false` - Authorization Code is the default. */
  readonly deviceFlow?: boolean;
  /** Pre-existing client identifier; skips DCR when supplied. */
  readonly clientId?: string;
  readonly scope?: string;
  /** Forwarded to the chosen flow. */
  readonly authorizeCode?: AuthorizeCodeOptions;
  readonly authorizeDevice?: AuthorizeDeviceOptions;
  readonly metadata?: CreateOAuthClientOptions['metadata'];
}
/**
 * Result returned by {@link loginInteractive}.
 *
 * @stable
 */
interface LoginInteractiveResult {
  readonly session: OAuthSession;
  readonly status: OAuthSessionMetadata;
  readonly client: OAuthClient;
}
/**
 * Drive an interactive login flow against the supplied server. The
 * function chooses Authorization Code by default and falls back to
 * the Device Authorization Grant when `deviceFlow: true`.
 *
 * @stable
 */
declare function loginInteractive(options: LoginInteractiveOptions): Promise<LoginInteractiveResult>;
/**
 * List the audit-safe metadata of every persisted OAuth session.
 *
 * @stable
 */
declare function listOAuthSessions(storage: OAuthServerStore, options?: {
  readonly secretsStore?: _graphorin_core_contracts1.SecretsStore;
}): Promise<ReadonlyArray<OAuthSessionMetadata>>;
/**
 * Refresh the OAuth session for `serverId`. Throws when the session
 * has no refresh token or when the authorization server rejects the
 * refresh.
 *
 * @stable
 */
declare function refreshOAuthSession(storage: OAuthServerStore, serverId: string, options?: {
  readonly signal?: AbortSignal;
  /** Resolves the persisted refresh token across processes. */
  readonly secretsStore?: _graphorin_core_contracts1.SecretsStore;
}): Promise<OAuthSession>;
/**
 * Revoke the OAuth session for `serverId`. The function always tears
 * the persisted record down even when the revocation endpoint
 * returns an error.
 *
 * @stable
 */
declare function revokeOAuthSession(storage: OAuthServerStore, serverId: string, options?: {
  readonly reason?: string;
  readonly signal?: AbortSignal;
  /** Resolves the persisted tokens so RFC 7009 actually fires. */
  readonly secretsStore?: _graphorin_core_contracts1.SecretsStore;
}): Promise<void>;
/**
 * Snapshot of the OAuth subsystem state. Used by `graphorin auth status`.
 *
 * @stable
 */
interface OAuthStatusSnapshot {
  readonly sessions: ReadonlyArray<OAuthSessionMetadata>;
  readonly providers: ReadonlyArray<{
    readonly id: string;
    readonly hasMatch: boolean;
  }>;
  readonly defaultStrategy: OAuthStrategy | null;
}
/**
 * Build the snapshot returned by `graphorin auth status` (Phase 15).
 *
 * @stable
 */
declare function getOAuthStatus(storage: OAuthServerStore, options?: {
  readonly secretsStore?: _graphorin_core_contracts1.SecretsStore;
}): Promise<OAuthStatusSnapshot>;
//#endregion
export { LoginInteractiveOptions, LoginInteractiveResult, OAuthStatusSnapshot, getOAuthStatus, listOAuthSessions, loginInteractive, refreshOAuthSession, revokeOAuthSession };
//# sourceMappingURL=library.d.ts.map