import * as data from '../data/index.js';
import * as plugins from '../plugins.js';
/**
 * Request to get the public keyset for JWT validation.
 *
 * **Direction:** Client → idp.global
 * **Requester:** Backend services that need to verify JWTs
 * **Handler:** idp.global
 *
 * Use this to fetch every currently accepted public key for verifying JWT signatures.
 * The backend token authenticates the requesting service.
 */
export interface IReq_GetPublicKeysForValidation extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_GetPublicKeysForValidation> {
    method: 'getPublicKeysForValidation';
    request: {
        backendToken: string;
    };
    response: {
        publicKeys: data.IJwtVerificationKey[];
    };
}
/**
 * Push the complete public keyset to connected backend services for JWT validation.
 *
 * **Direction:** idp.global → Client
 * **Requester:** idp.global (pushes when the JWT signing key rotates)
 * **Handler:** Backend services - must register a TypedHandler for this method
 *
 * Backend services must register a matching handler to receive key-rotation
 * updates and replace their local verification keyset.
 */
export interface IReq_PushPublicKeysForValidation extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_PushPublicKeysForValidation> {
    method: 'pushPublicKeysForValidation';
    request: {
        publicKeys: data.IJwtVerificationKey[];
    };
    response: {};
}
/**
 * Push or get JWT ID blocklist for revoked tokens.
 *
 * **Bidirectional:**
 * - **GET direction:** Client → idp.global - Client requests current blocklist
 * - **PUSH direction:** idp.global → Client - Server pushes the complete current blocklist snapshot
 *
 * **For GET (client fires):**
 * - Fire with empty/undefined `blockedJwtIds` to request the full blocklist
 * - Include `backendToken` to authenticate as a backend service
 * - Response contains the complete list of blocked JWT IDs
 * - Use `IdpClient.requests.getJwtIdBlocklist` for this direction
 *
 * **For PUSH (idp.global fires):**
 * - idp.global sends the complete current persisted blocklist snapshot to connected clients
 * - Clients must register a handler using `IdpClient.onBlocklistPush()`
 * - Each push contains the complete current persisted list; replace the local
 *   snapshot rather than treating it as an incremental append
 */
export interface IReq_PushOrGetJwtIdBlocklist extends plugins.typedRequestInterfaces.implementsTR<plugins.typedRequestInterfaces.ITypedRequest, IReq_PushOrGetJwtIdBlocklist> {
    method: 'pushOrGetJwtIdBlocklist';
    request: {
        /**
         * Authenticates the requesting backend service in the GET direction
         * (Client → idp.global). Required by the idp.global handler.
         * Omitted in the PUSH direction (idp.global → Client) so the secret
         * never travels to connected clients.
         */
        backendToken?: string;
        blockedJwtIds?: string[];
    };
    response: {
        blockedJwtIds?: string[];
    };
}