import { I as IdPStores, a as IdPConfig } from './config-DM9VXfrR.js';
import * as h3 from 'h3';
import { EventHandler } from 'h3';
import * as _openape_core from '@openape/core';
import { ProblemDetails } from '@openape/core';
import * as _openape_auth from '@openape/auth';
import '@openape/grants';

declare function createChallengeHandler(stores: IdPStores, _config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    challenge: string;
}>>;
declare function createAuthenticateHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    token: string;
    id: string;
    email: string;
    name: string;
    act: "human" | "agent";
    expires_in: number;
}>>;

declare function createEnrollHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    email: string;
    name: string;
    owner: string | undefined;
    approver: string | undefined;
    type: "human" | "agent";
    status: string;
}>>;

declare function createAuthorizeHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<void>>;

declare function createTokenHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    error: string;
    error_description: string;
} | {
    access_token: string;
    token_type: string;
    expires_in: number;
}>>;

declare function createJWKSHandler(stores: IdPStores): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    keys: {
        kid: string;
        alg: string;
        use: string;
        crv?: string;
        d?: string;
        dp?: string;
        dq?: string;
        e?: string;
        k?: string;
        n?: string;
        p?: string;
        q?: string;
        qi?: string;
        x?: string;
        y?: string;
        kty: string;
        key_ops?: string[];
        ext?: boolean;
        x5c?: string[];
        x5t?: string;
        'x5t#S256'?: string;
        x5u?: string;
    }[];
}>>;

declare function createDiscoveryHandler(config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, {
    issuer: string;
    authorization_endpoint: string;
    token_endpoint: string;
    userinfo_endpoint: string;
    jwks_uri: string;
    response_types_supported: string[];
    revocation_endpoint: string;
    grant_types_supported: string[];
    subject_types_supported: string[];
    id_token_signing_alg_values_supported: string[];
    token_endpoint_auth_methods_supported: string[];
    token_endpoint_auth_signing_alg_values_supported: string[];
    code_challenge_methods_supported: string[];
    scopes_supported: string[];
    claims_supported: string[];
    authorization_details_types_supported: string[];
    ddisa_version: string;
    ddisa_auth_methods_supported: string[];
    ddisa_auth_challenge_endpoint: string;
    ddisa_auth_authenticate_endpoint: string;
    openape_grants_endpoint: string;
    openape_delegations_endpoint: string;
    openape_grant_types_supported: string[];
    openape_grant_categories_supported: string[];
}>;

declare function createListGrantsHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<_openape_core.PaginatedResponse<_openape_core.OpenApeGrant>>>;
declare function createCreateGrantHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<_openape_core.OpenApeGrant>>;
declare function createGetGrantHandler(stores: IdPStores): h3.EventHandler<h3.EventHandlerRequest, Promise<"" | _openape_core.OpenApeGrant>>;
declare function createApproveGrantHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    grant: _openape_core.OpenApeGrant;
    authz_jwt: string;
}>>;
declare function createDenyGrantHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<_openape_core.OpenApeGrant>>;
declare function createRevokeGrantHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<_openape_core.OpenApeGrant>>;
declare function createGrantTokenHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    authz_jwt: string;
    grant: _openape_core.OpenApeGrant;
}>>;
declare function createConsumeGrantHandler(stores: IdPStores): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    error: string;
    status: "used";
    grant?: undefined;
} | {
    error: string;
    status: "revoked";
    grant?: undefined;
} | {
    error: string;
    status: "denied";
    grant?: undefined;
} | {
    error: string;
    status: "expired";
    grant?: undefined;
} | {
    error: string;
    status: "pending";
    grant?: undefined;
} | {
    status: string;
    grant: _openape_core.OpenApeGrant;
    error?: undefined;
}>>;
interface BatchResult {
    id: string;
    status: string;
    success: boolean;
    error?: ProblemDetails;
}
declare function createBatchGrantHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    results: BatchResult[];
}>>;
declare function createVerifyGrantHandler(stores: IdPStores, _config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    valid: boolean;
    error: string | undefined;
    claims?: undefined;
    grant?: undefined;
} | {
    valid: boolean;
    claims: _openape_core.OpenApeAuthZClaims | undefined;
    grant: _openape_core.OpenApeGrant;
    error?: undefined;
}>>;

declare function createListUsersHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    data: {
        email: string;
        name: string;
        isActive: boolean;
        owner: string | undefined;
        createdAt: number;
    }[];
    pagination: {
        cursor: string | null;
        has_more: boolean;
    };
}>>;
declare function createDeleteUserHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    ok: boolean;
}>>;
declare function createCreateUserHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    ok: boolean;
    email: string;
    name: string;
}>>;
declare function createAddSshKeyHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    keyId: string;
    userEmail: string;
    publicKey: string;
    name: string;
    createdAt: number;
}>>;
declare function createListSshKeysHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<_openape_auth.SshKey[]>>;
declare function createDeleteSshKeyHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    ok: boolean;
}>>;

declare function createCreateDelegationHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<_openape_core.OpenApeGrant>>;
declare function createListDelegationsHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    data: _openape_core.OpenApeGrant[];
    pagination: {
        cursor: string | null;
        has_more: boolean;
    };
}>>;
declare function createRevokeDelegationHandler(stores: IdPStores, config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<_openape_core.OpenApeGrant>>;
declare function createValidateDelegationHandler(stores: IdPStores, _config: IdPConfig): h3.EventHandler<h3.EventHandlerRequest, Promise<{
    valid: boolean;
    delegation: _openape_core.OpenApeGrant;
    scopes: string[];
    error?: undefined;
} | {
    valid: boolean;
    error: string;
    delegation?: undefined;
    scopes?: undefined;
}>>;

/**
 * POST /api/session/login
 *
 * Headless session login: accepts { id, challenge, signature },
 * verifies the ed25519 signature, and sets a session cookie with { userId }.
 */
declare function createSessionLoginHandler(stores: IdPStores, config: IdPConfig): EventHandler<h3.EventHandlerRequest, Promise<{
    ok: boolean;
}>>;
/**
 * POST /api/session/logout
 *
 * Clears the IdP session cookie.
 */
declare function createSessionLogoutHandler(stores: IdPStores, config: IdPConfig): EventHandler<h3.EventHandlerRequest, Promise<{
    ok: boolean;
}>>;
/**
 * GET /login
 *
 * Returns the returnTo parameter as JSON.
 * In a real app this would render a login form;
 * for headless/test usage it signals that login is required.
 */
declare function createLoginPageHandler(): EventHandler;

export { IdPConfig, IdPStores, createAddSshKeyHandler, createApproveGrantHandler, createAuthenticateHandler, createAuthorizeHandler, createBatchGrantHandler, createChallengeHandler, createConsumeGrantHandler, createCreateDelegationHandler, createCreateGrantHandler, createCreateUserHandler, createDeleteSshKeyHandler, createDeleteUserHandler, createDenyGrantHandler, createDiscoveryHandler, createEnrollHandler, createGetGrantHandler, createGrantTokenHandler, createJWKSHandler, createListDelegationsHandler, createListGrantsHandler, createListSshKeysHandler, createListUsersHandler, createLoginPageHandler, createRevokeDelegationHandler, createRevokeGrantHandler, createSessionLoginHandler, createSessionLogoutHandler, createTokenHandler, createValidateDelegationHandler, createVerifyGrantHandler };