import { SmrtObjectOptions, SmrtObject } from '@happyvertical/smrt-core';
import { SocialPlatformType } from './social-account.js';
/**
 * OAuth state creation options
 */
export interface OAuthStateOptions extends SmrtObjectOptions {
    /**
     * Platform being connected
     */
    platform?: SocialPlatformType;
    /**
     * CSRF state token
     */
    state?: string;
    /**
     * PKCE code verifier (for platforms that require it)
     */
    codeVerifier?: string | null;
    /**
     * Redirect URI used in the OAuth request
     */
    redirectUri?: string;
    /**
     * Requested OAuth scopes
     */
    scopes?: string[];
    /**
     * When this state expires
     */
    expiresAt?: Date;
    /**
     * Tenant ID for multi-tenant isolation
     */
    tenantId?: string | null;
}
/**
 * Temporary OAuth state for social account connection
 *
 * OAuthState stores temporary data during the OAuth flow to:
 * - Verify callback requests match initiated requests (CSRF protection)
 * - Store PKCE code verifier for code exchange
 * - Track redirect URI and scopes for verification
 *
 * These records should be cleaned up after successful connection
 * or after expiration.
 *
 * @example
 * ```typescript
 * import { OAuthState } from '@happyvertical/smrt-social';
 *
 * // Create state when initiating OAuth
 * const state = new OAuthState({
 *   platform: 'youtube',
 *   state: crypto.randomUUID(),
 *   codeVerifier: generatePKCEVerifier(),
 *   redirectUri: 'https://app.example.com/oauth/callback',
 *   scopes: ['youtube.upload', 'youtube.readonly'],
 *   expiresAt: new Date(Date.now() + 10 * 60 * 1000), // 10 minutes
 * });
 * await state.save();
 *
 * // After successful callback, delete the state
 * await state.delete();
 * ```
 */
export declare class OAuthState extends SmrtObject {
    /**
     * Tenant ID for multi-tenant isolation
     */
    tenantId: string | null;
    /**
     * Platform being connected
     */
    platform: SocialPlatformType;
    /**
     * CSRF state token
     * This is sent to the OAuth provider and verified on callback
     */
    state: string;
    /**
     * PKCE code verifier
     * Required for platforms using PKCE (YouTube, etc.)
     */
    codeVerifier: string | null;
    /**
     * Redirect URI used in the OAuth request
     * Must match on callback for verification
     */
    redirectUri: string;
    /**
     * Requested OAuth scopes
     */
    scopes: string[];
    /**
     * When this state expires
     * States should be short-lived (10 minutes typical)
     */
    expiresAt: Date;
    constructor(options?: OAuthStateOptions);
    /**
     * Check if the state has expired
     */
    get isExpired(): boolean;
    /**
     * Check if the state is still valid
     */
    get isValid(): boolean;
    /**
     * Verify a callback state matches this record
     */
    verifyState(callbackState: string): boolean;
    /**
     * Generate a new random state token
     */
    static generateState(): string;
    /**
     * Generate a PKCE code verifier
     * Returns a 43-128 character random string
     */
    static generateCodeVerifier(): string;
    /**
     * Generate PKCE code challenge from verifier (S256 method)
     * Note: This requires async crypto operations
     */
    static generateCodeChallenge(verifier: string): Promise<string>;
}
//# sourceMappingURL=oauth-state.d.ts.map