import { type Guard, type Principal, type StoreAdapter, type StoreOps } from "@vendoai/core";
import type { VendoTheme } from "@vendoai/apps/contract";
import { z } from "zod";
import type { HostOAuthAdapter } from "./adapter.js";
/** RFC 8693 §2.1. */
export declare const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
declare const accessGrantSchema: z.ZodObject<{
    kind: z.ZodLiteral<"access">;
    subject: z.ZodString;
    clientId: z.ZodString;
    familyId: z.ZodOptional<z.ZodString>;
    resource: z.ZodString;
    scopes: z.ZodArray<z.ZodString, "many">;
    expiresAt: z.ZodString;
    revokedAt: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    scopes: string[];
    kind: "access";
    subject: string;
    clientId: string;
    resource: string;
    expiresAt: string;
    familyId?: string | undefined;
    revokedAt?: string | undefined;
}, {
    scopes: string[];
    kind: "access";
    subject: string;
    clientId: string;
    resource: string;
    expiresAt: string;
    familyId?: string | undefined;
    revokedAt?: string | undefined;
}>;
type AccessGrant = z.infer<typeof accessGrantSchema>;
interface RevokedGrant {
    subject: string;
    clientId: string;
    tokenType: "access_token" | "refresh_token";
    familyId?: string;
}
interface RevocationResult {
    response: Response;
    grant?: RevokedGrant;
}
export interface AuthenticatedGrant {
    grant: AccessGrant;
    tokenWasPresented: boolean;
}
interface OAuthServerConfig {
    oauth: HostOAuthAdapter;
    store: StoreAdapter;
    /** The 42-op surface over that SAME store, when the composition could resolve
     *  one (`selectStoreOps` answers `undefined` for a store with neither its own
     *  ops nor a SQL handle). Both drawers this door owns — the registered clients
     *  and the grant family: consents, codes, access and refresh grants — go
     *  through `ops.engine.*`, so the allowlist gate applies to all of them.
     *  Unset, `engineOverAdapter` serves the same seven verbs off the adapter's
     *  own record doors, which is what a host's BYO `StoreAdapter` gets. */
    ops?: StoreOps;
    guard: Guard;
    theme?: VendoTheme;
    serviceAuth?: {
        keys: readonly string[];
    };
}
export declare class OAuthServer {
    #private;
    constructor(config: OAuthServerConfig);
    get hasPrebuiltConsent(): boolean;
    register(req: Request): Promise<Response>;
    authorize(req: Request, resource: string): Promise<Response>;
    token(req: Request, resource: string): Promise<Response>;
    authenticate(req: Request): Promise<AuthenticatedGrant | null>;
    revoke(req: Request): Promise<RevocationResult>;
    /** Host-side per-client disconnect. The caller owns host authorization for
     * this API; the door atomically revokes every existing grant family. */
    revokeClient(subject: string, clientId: string): Promise<boolean>;
    principal(subject: string): Promise<Principal | null>;
    auditRevoke(subject: string, clientId: string): Promise<void>;
}
export declare function randomHex(byteLength: number): string;
export declare function json(body: unknown, status?: number, extraHeaders?: Record<string, string>): Response;
export declare function canonicalUri(input: string): string;
export declare function sameCanonicalUri(left: string, right: string): boolean;
export {};
//# sourceMappingURL=server.d.ts.map