import type { Db } from './db.js';
import { oauthCodes, oauthTokens } from './schema.js';
/** Persistence for the built-in OAuth 2.1 authorization server. Callers pass hashes, never raw secrets. */
export declare function getOAuthClient(db: Db, clientId: string): Promise<Record<string, unknown> | undefined>;
export declare function saveOAuthClient(db: Db, clientId: string, info: Record<string, unknown>): Promise<void>;
export declare function saveOAuthCode(db: Db, row: typeof oauthCodes.$inferInsert): Promise<void>;
/** A live (unused, unexpired) code for this client, without consuming it. */
export declare function peekOAuthCode(db: Db, codeHash: string, clientId: string): Promise<{
    codeHash: string;
    clientId: string;
    subject: string;
    scopes: string[];
    codeChallenge: string;
    redirectUri: string;
    resource: string | null;
    expiresAt: Date;
    usedAt: Date | null;
} | null>;
/** Atomically mark a code used; returns it only if this call won (codes are single-use). */
export declare function consumeOAuthCode(db: Db, codeHash: string, clientId: string): Promise<{
    codeHash: string;
    clientId: string;
    subject: string;
    scopes: string[];
    codeChallenge: string;
    redirectUri: string;
    resource: string | null;
    expiresAt: Date;
    usedAt: Date | null;
} | null>;
export declare function saveOAuthTokens(db: Db, rows: Array<typeof oauthTokens.$inferInsert>): Promise<void>;
/** A live token of the given kind. */
export declare function findOAuthToken(db: Db, tokenHash: string, kind: 'access' | 'refresh'): Promise<{
    tokenHash: string;
    kind: "access" | "refresh";
    clientId: string;
    subject: string;
    scopes: string[];
    resource: string | null;
    createdAt: Date;
    expiresAt: Date;
    revokedAt: Date | null;
} | null>;
/** Revoke one token; a refresh token is only revoked once, so concurrent refreshes cannot both win. */
export declare function revokeOAuthToken(db: Db, tokenHash: string): Promise<boolean>;
/** Sign a user out everywhere. */
export declare function revokeOAuthSubject(db: Db, subject: string): Promise<number>;
export declare function listOAuthSessions(db: Db): Promise<import("postgres").RowList<{
    subject: string;
    client_id: string;
    scopes: string[];
    last_issued: Date;
    refresh_expires: Date;
}[]>>;
/** Housekeeping: drop expired codes and long-dead tokens. */
export declare function purgeOAuth(db: Db): Promise<void>;
//# sourceMappingURL=oauth.d.ts.map