import { SmrtClassOptions } from '@happyvertical/smrt-core';
import { OidcClaims, OidcIdentityResult, OidcProfileOwnerAuthorizer, OidcProfileResolver } from '../collections/UserCollection.js';
export type OidcProviderKind = 'kanidm' | 'dex' | 'generic';
export type OidcTokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
export interface OidcProviderConfig {
    /**
     * Optional preset label for documentation and UI.
     *
     * Kanidm and Dex are standards-compliant OIDC providers, so the preset does
     * not change protocol behavior; it lets apps name their intent clearly.
     */
    kind?: OidcProviderKind;
    /** OIDC issuer URL, e.g. https://id.example.com/dex */
    issuer: string;
    /** OAuth2/OIDC client ID registered with the provider */
    clientId: string;
    /** OAuth2/OIDC client secret for confidential clients */
    clientSecret?: string;
    /**
     * Redirect URI registered with the provider.
     *
     * SvelteKit helpers can derive this from the current request when omitted.
     */
    redirectUri?: string;
    /** Scopes to request. Defaults to openid profile email. */
    scopes?: string[];
    /** Override the discovery document URL when needed. */
    discoveryUrl?: string;
    /** Additional authorization request parameters. */
    authorizationParams?: Record<string, string | number | boolean | undefined>;
    /**
     * Client authentication method for the token endpoint.
     *
     * Defaults to client_secret_basic when clientSecret exists, otherwise none.
     */
    tokenEndpointAuthMethod?: OidcTokenEndpointAuthMethod;
}
export interface OidcProviderResolutionOptions {
    defaultProvider?: string;
    providers?: Record<string, OidcProviderConfig>;
}
export interface UsersOidcConfig extends OidcProviderResolutionOptions {
    /** Seconds before login transaction cookies expire. */
    transactionTtl?: number;
}
export interface OidcProviderResolution {
    provider: OidcProviderConfig;
    providerName: string;
}
export interface ResolvedOidcProviderConfig extends OidcProviderConfig {
    redirectUri: string;
}
export interface OidcProviderMetadata {
    authorization_response_iss_parameter_supported?: boolean;
    authorization_endpoint: string;
    end_session_endpoint?: string;
    issuer: string;
    jwks_uri: string;
    token_endpoint: string;
    userinfo_endpoint?: string;
    [key: string]: unknown;
}
export interface OidcTransaction {
    codeVerifier: string;
    createdAt: number;
    nonce: string;
    provider: string;
    returnTo?: string;
    state: string;
}
export interface CreateAuthorizationUrlOptions {
    authorizationParams?: Record<string, string | number | boolean | undefined>;
    transaction?: OidcTransaction;
}
export interface OidcTokenSet {
    accessToken?: string;
    expiresAt?: Date;
    idToken: string;
    refreshToken?: string;
    scope?: string;
    tokenType?: string;
}
export interface OidcCallbackResult {
    claims: OidcClaims;
    tokens: OidcTokenSet;
}
export interface OidcLoginResult extends OidcIdentityResult {
    claims: OidcClaims;
    tokens: OidcTokenSet;
}
export interface OidcLoginServiceOptions extends SmrtClassOptions {
    /** Provider key, e.g. kanidm or dex */
    providerName: string;
    /** Fully resolved provider config. redirectUri is required here. */
    provider: ResolvedOidcProviderConfig;
    /** Optional fetch override for tests or custom runtimes. */
    fetch?: typeof fetch;
    /** JWT clock tolerance passed to jose. Defaults to 15 seconds. */
    clockTolerance?: number | string;
    /** Provider metadata cache TTL in milliseconds. Defaults to 5 minutes. */
    metadataCacheTtlMs?: number;
    /**
     * Application Profile resolver invoked after claims validation and before
     * OIDC identity, User, or session creation.
     */
    resolveProfile?: OidcProfileResolver;
    /**
     * Explicitly authorize first binding to a pre-provisioned canonical Profile
     * and its existing User owner after protocol claim validation.
     */
    authorizeProfileOwner?: OidcProfileOwnerAuthorizer;
}
export declare class OidcLoginError extends Error {
    constructor(message: string);
}
export declare function getUsersOidcConfig(): UsersOidcConfig;
export declare function encodeOidcTransaction(transaction: OidcTransaction): string;
export declare function decodeOidcTransaction(value: string): OidcTransaction;
export declare function resolveOidcProviderConfig(providerName?: string, options?: OidcProviderResolutionOptions): OidcProviderResolution;
export declare class OidcLoginService {
    private readonly classOptions;
    private readonly clockTolerance;
    private readonly fetchImpl;
    private readonly metadataCacheTtlMs;
    private readonly authorizeProfileOwner?;
    private readonly resolveProfile?;
    private metadataFetchedAt;
    private metadataPromise?;
    private remoteJwks?;
    readonly provider: ResolvedOidcProviderConfig;
    readonly providerName: string;
    constructor(options: OidcLoginServiceOptions);
    createTransaction(returnTo?: string): OidcTransaction;
    getMetadata(): Promise<OidcProviderMetadata>;
    private fetchMetadata;
    createAuthorizationUrl(options?: CreateAuthorizationUrlOptions): Promise<{
        transaction: OidcTransaction;
        url: URL;
    }>;
    exchangeCallback(callbackUrl: string | URL, transaction: OidcTransaction): Promise<OidcCallbackResult>;
    completeLogin(callbackUrl: string | URL, transaction: OidcTransaction): Promise<OidcLoginResult>;
    private validateCallback;
    private validateCallbackEnvelope;
    private exchangeCode;
    private enrichClaimsFromUserInfo;
    private verifyIdToken;
}
//# sourceMappingURL=OidcLoginService.d.ts.map