import { type OIDCProvider, OIDCError } from './oidc-provider.js';
import { type OIDCProviderConfig, type AuthorizationState, type AuthorizationUrlResult, type TokenExchangeRequest, type TokenExchangeResult, type TokenRefreshResult, type OIDCTokenSet, type IDTokenClaims, type OIDCUserInfo, type SSOSession, type SSOErrorCode, type SSOManagerConfig } from './types.js';
export { OIDCError } from './oidc-provider.js';
/**
 * SSO Manager Error
 */
export declare class SSOError extends OIDCError {
    constructor(message: string, code: SSOErrorCode, options?: {
        providerId?: string;
        originalError?: Error;
        details?: Record<string, unknown>;
    });
}
/**
 * SSOManager - Manages multiple OIDC providers and SSO flows
 *
 * Provides a unified interface for SSO authentication across multiple identity providers.
 * Supports PKCE-enhanced authorization code flow, token management, user provisioning,
 * and tenant mapping.
 *
 * @example
 * ```typescript
 * const manager = getSSOManager({
 *   onProvisionUser: async (user) => {
 *     const userId = await userService.createUser(user);
 *     return userId;
 *   },
 *   onLookupUser: async (providerId, externalId) => {
 *     return userService.findByExternalId(providerId, externalId);
 *   }
 * });
 *
 * // Register a provider
 * await manager.registerProvider({
 *   id: 'okta-prod',
 *   name: 'Okta Production',
 *   type: 'okta',
 *   enabled: true,
 *   issuer: 'https://company.okta.com',
 *   clientId: 'xxx',
 *   clientSecret: 'xxx',
 *   redirectUri: 'https://app.example.com/auth/callback',
 *   scopes: ['openid', 'profile', 'email'],
 *   pkceEnabled: true,
 *   tenantMapping: 'domain',
 *   domainTenantMap: { 'company.com': 'tenant-1' },
 *   jitProvisioningEnabled: true,
 *   requestRefreshToken: true,
 * });
 *
 * // Start login
 * const { url, state } = await manager.startLogin('okta-prod', {
 *   returnUrl: '/dashboard'
 * });
 *
 * // Complete login after callback
 * const result = await manager.completeLogin({
 *   code: callbackCode,
 *   state: callbackState,
 *   storedState: savedState
 * });
 * ```
 */
export declare class SSOManager {
    private readonly config;
    private readonly providers;
    private readonly providerConfigs;
    private readonly sessions;
    private readonly stateStore;
    constructor(config?: Partial<SSOManagerConfig>);
    /**
     * Register an OIDC provider
     */
    registerProvider(config: OIDCProviderConfig): Promise<void>;
    /**
     * Unregister an OIDC provider
     */
    unregisterProvider(providerId: string): boolean;
    /**
     * Get a provider by ID
     */
    getProvider(providerId: string): OIDCProvider | undefined;
    /**
     * Get provider configuration by ID
     */
    getProviderConfig(providerId: string): OIDCProviderConfig | undefined;
    /**
     * List all registered providers
     */
    listProviders(): Array<{
        id: string;
        name: string;
        type: string;
        enabled: boolean;
    }>;
    /**
     * List enabled providers only
     */
    listEnabledProviders(): Array<{
        id: string;
        name: string;
        type: string;
    }>;
    /**
     * Enable a provider
     */
    enableProvider(providerId: string): Promise<void>;
    /**
     * Disable a provider
     */
    disableProvider(providerId: string): void;
    /**
     * Start login flow - generate authorization URL
     */
    startLogin(providerId: string, options?: {
        returnUrl?: string;
        tenantId?: string;
        metadata?: Record<string, unknown>;
    }): Promise<AuthorizationUrlResult>;
    /**
     * Complete login flow - exchange code for tokens
     */
    completeLogin(request: TokenExchangeRequest, options?: {
        fetchUserInfo?: boolean;
    }): Promise<TokenExchangeResult>;
    /**
     * Validate and retrieve stored state
     */
    getStoredState(stateParam: string): AuthorizationState | undefined;
    /**
     * Clean up expired states
     */
    cleanupExpiredStates(): number;
    /**
     * Refresh tokens for a session
     */
    refreshTokens(providerId: string, refreshToken: string): Promise<TokenRefreshResult>;
    /**
     * Revoke a token
     */
    revokeToken(providerId: string, token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void>;
    /**
     * Fetch user info with access token
     */
    fetchUserInfo(providerId: string, accessToken: string): Promise<OIDCUserInfo>;
    /**
     * Create an SSO session
     */
    createSession(userId: string, providerId: string, externalSubjectId: string, tenantId: string, tokens: OIDCTokenSet, claims: IDTokenClaims, metadata?: Record<string, unknown>): SSOSession;
    /**
     * Get an SSO session
     */
    getSession(sessionId: string): SSOSession | undefined;
    /**
     * Update session tokens (after refresh)
     */
    updateSessionTokens(sessionId: string, tokens: OIDCTokenSet, claims?: IDTokenClaims): boolean;
    /**
     * Terminate an SSO session
     */
    terminateSession(sessionId: string): Promise<boolean>;
    /**
     * Get sessions for a user
     */
    getSessionsForUser(userId: string): SSOSession[];
    /**
     * Terminate all sessions for a user
     */
    terminateSessionsForUser(userId: string): Promise<number>;
    /**
     * Generate logout URL for a provider
     */
    generateLogoutUrl(providerId: string, options?: {
        idToken?: string;
        postLogoutRedirectUri?: string;
        state?: string;
    }): string | null;
    /**
     * Perform full logout (terminate session and generate logout URL)
     */
    logout(sessionId: string, options?: {
        postLogoutRedirectUri?: string;
    }): Promise<{
        logoutUrl: string | null;
    }>;
    /**
     * Resolve tenant ID from claims and configuration
     */
    private resolveTenant;
    /**
     * Resolve user - look up existing or provision new user
     */
    private resolveUser;
    /**
     * Provision a new user via JIT
     */
    private provisionUser;
    /**
     * Get an initialized provider or throw
     */
    private getInitializedProvider;
    /**
     * Generate a unique session ID
     */
    private generateSessionId;
    /**
     * Emit an audit event
     */
    private emitAuditEvent;
    /**
     * Clear all caches
     */
    clearAllCaches(): void;
    /**
     * Get manager statistics
     */
    getStats(): {
        providers: number;
        enabledProviders: number;
        activeSessions: number;
        pendingStates: number;
    };
}
/**
 * Get the singleton SSOManager instance
 *
 * @param config - Configuration (only used on first call)
 * @returns The SSOManager singleton
 */
export declare function getSSOManager(config?: Partial<SSOManagerConfig>): SSOManager;
/**
 * Reset the singleton instance (primarily for testing)
 */
export declare function resetSSOManager(): void;
export { type OIDCProviderConfig, type OIDCProviderType, type TenantMappingStrategy, type JITClaimMappings, type AuthorizationState, type AuthorizationUrlResult, type TokenExchangeRequest, type TokenExchangeResult, type TokenRefreshResult, type OIDCTokenSet, type IDTokenClaims, type OIDCUserInfo, type JITProvisionedUser, type SSOSession, type SSOAuditEvent, type SSOEventType, type SSOManagerConfig, type SSOErrorCode, type SSOErrorDetails, OIDCProviderConfigSchema, AuthorizationCallbackSchema, DEFAULT_SSO_MANAGER_CONFIG, } from './types.js';
export { OIDCProvider, createOIDCProvider, clearAllDiscoveryCaches, } from './oidc-provider.js';
//# sourceMappingURL=index.d.ts.map