import { SecretValue } from "../secrets/secret-value.js";
import { DiscoveredMetadata, OAuthRegistration, OAuthSession } from "./types.js";

//#region src/oauth/refresh.d.ts

/** Internal arguments for the refresh helper. */
interface RefreshAccessTokenArgs {
  readonly serverId: string;
  readonly metadata: DiscoveredMetadata;
  readonly registration: OAuthRegistration;
  readonly refreshToken: SecretValue;
  readonly scope?: string;
  readonly signal?: AbortSignal;
  /**
   * When `true` and the authorization server **rotates** the refresh
   * token (RFC 6749 §10.4 / OAuth 2.1 - the token response carries a
   * *different* `refresh_token`), best-effort revoke the previous
   * refresh token via {@link revokeOAuthToken}. Defaults to `false` so
   * existing callers are unaffected; servers that already invalidate
   * the old token on rotation make this a defense-in-depth no-op.
   * Revocation failures never fail the refresh.
   */
  readonly revokePreviousOnRotation?: boolean;
  /**
   * Bypass the in-flight dedupe: a forced refresh always
   * issues a fresh token-endpoint request instead of joining the
   * shared in-flight promise.
   */
  readonly force?: boolean;
}
/**
 * Refresh the access token. Identical concurrent invocations share a
 * single in-flight request; subsequent callers observe the same
 * resolved session.
 *
 * @stable
 */
declare function refreshAccessToken(args: RefreshAccessTokenArgs): Promise<OAuthSession>;
/**
 * Reset the inflight refresh map. Used by tests.
 *
 * @experimental
 */
declare function _resetInflightRefreshForTesting(): void;
/**
 * Snapshot of the current inflight set. Used by tests.
 *
 * @experimental
 */
declare function _getInflightRefreshKeysForTesting(): ReadonlyArray<string>;
/** Strategy hook used by tests to stub the revoke request. */
type RevocationFetcher = (url: string, init: {
  body: string;
  signal?: AbortSignal;
  basicAuth?: string;
}) => Promise<{
  ok: boolean;
  status: number;
  statusText?: string;
}>;
/**
 * Override the revocation fetcher. Used by the test suite.
 *
 * @experimental
 */
declare function _setRevocationFetcherForTesting(fetcher: RevocationFetcher | null): void;
/** Internal arguments for the revoke helper. */
interface RevokeOAuthTokenArgs {
  readonly serverId: string;
  readonly metadata: DiscoveredMetadata;
  readonly registration: OAuthRegistration;
  readonly token: SecretValue;
  readonly tokenTypeHint?: 'access_token' | 'refresh_token';
  readonly signal?: AbortSignal;
}
/**
 * Revoke an OAuth token via RFC 7009. Honest failure semantics:
 * a missing revocation endpoint, a network failure,
 * and a non-2xx response all **throw** - the caller decides whether
 * teardown proceeds, and the audit trail never claims a server-side
 * revocation that was not confirmed.
 *
 * @stable
 */
declare function revokeOAuthToken(args: RevokeOAuthTokenArgs): Promise<void>;
//#endregion
export { RefreshAccessTokenArgs, RevocationFetcher, RevokeOAuthTokenArgs, _getInflightRefreshKeysForTesting, _resetInflightRefreshForTesting, _setRevocationFetcherForTesting, refreshAccessToken, revokeOAuthToken };
//# sourceMappingURL=refresh.d.ts.map