import type { ResolvedEntity } from '@owlmeans/entrypoint';
import type { OidcOrganizationClaim, OidcPermissionSetClaim } from '@owlmeans/oidc';
import type { AuthSpent } from '@owlmeans/server-auth';
import type { OidcTokenSetParameters } from '../types.js';
export interface OIDCAuthCache extends AuthSpent {
    verifier?: string;
    payload?: OidcTokenSetParameters;
    client?: string;
    validated?: Date;
    entityId?: string;
    profileId?: string;
    /** Absolute expiry; cache refreshes must never slide this session beyond its initial TTL. */
    expiresAt?: number;
    redirectUri?: string;
    /** Verifier record: the organization the person asked to act in at sign-in. */
    entitySlug?: string;
    /**
     * Session record: the `entityKey` of the organization the session acts in. Absent on a session
     * whose provider claims no organizations — that one keeps the pre-tenancy behaviour throughout.
     */
    acting?: string;
    /** Session record: the acting organization as the guard attaches it to each request. */
    entity?: ResolvedEntity;
    /** Session record: the provider's last `organizations` claim. Server-side only. */
    organizations?: OidcOrganizationClaim[];
    /** Session record: the provider's last permission claim, bound sets included. Server-side only. */
    sets?: OidcPermissionSetClaim[];
}
export interface OrganizationSelector {
    /** The organization a running session acts in. When given it is the only acceptable answer. */
    entityKey?: string;
    /** The organization a person asked to act in at sign-in. */
    entitySlug?: string;
}
//# sourceMappingURL=types.d.ts.map