import type { HttpClient } from "../core/http.js";
import type { TokenRequest, AgentTokenRequest, UserApiKeyTokenRequest, GoogleAuthRequest, SignupRequest, ChangePasswordRequest, ForgotPasswordRequest, ForgotPasswordResponse, ResetPasswordRequest, ResetPasswordResponse, TokenResponse, TokenExchangeRequest, TokenExchangeResponse, UserProfileResponse, UpdateProfileRequest, DeleteAccountRequest, ExportDataResponse, OneclawResponse, PKCEPair, UserInfoResponse, BuildAuthorizeUrlParams, OAuthRevokeRequest, OAuthRevokeResponse, OAuthConsentRevokeResponse } from "../types.js";
/**
 * Generate a PKCE code_verifier and code_challenge pair (S256).
 *
 * Works in browsers (Web Crypto) and Node 18+ (globalThis.crypto).
 */
export declare function generatePKCE(): Promise<PKCEPair>;
/**
 * Build a full 1Claw OAuth authorize URL with all query parameters.
 *
 * Combine with `generatePKCE()` to implement a complete PKCE flow.
 */
export declare function buildAuthorizeUrl(baseUrl: string, params: BuildAuthorizeUrlParams): string;
export interface EmailOtpSendRequest {
    email: string;
    platform_app_id?: string;
}
export interface EmailOtpSendResponse {
    status: string;
}
export interface EmailOtpVerifyRequest {
    email: string;
    code: string;
    platform_app_id?: string;
    auto_provision_chains?: string[];
}
export interface EmailOtpVerifyResponse {
    access_token: string;
    token_type: string;
    user_id: string;
    org_id: string;
    is_new: boolean;
}
export interface SocialLoginRequest {
    provider: string;
    id_token: string;
    auto_provision_chains?: string[];
    oauth_redirect_uri?: string;
}
export interface SocialLoginResponse {
    access_token: string;
    token_type: string;
    user_id: string;
    org_id: string;
    is_new: boolean;
}
export interface OAuthTokenRequest {
    grant_type?: string;
    code: string;
    client_id: string;
    redirect_uri: string;
    code_verifier?: string;
}
export interface OAuthTokenResponse {
    access_token: string;
    token_type: string;
    expires_in: number;
    refresh_token?: string;
    id_token?: string;
}
/**
 * Auth resource — authenticate users and agents, manage sessions.
 * Successful authentication automatically stores the JWT on the client
 * so subsequent requests are authenticated.
 */
export declare class AuthResource {
    private readonly http;
    constructor(http: HttpClient);
    /**
     * Authenticate with email and password.
     * Stores the resulting JWT for subsequent requests.
     */
    login(credentials: TokenRequest): Promise<OneclawResponse<TokenResponse>>;
    /**
     * Create a new account with email and password.
     * Creates a new organization, returns a JWT, and automatically
     * claims any pending email-based secret shares.
     */
    signup(credentials: SignupRequest): Promise<OneclawResponse<TokenResponse>>;
    /**
     * Authenticate an agent using its ID and API key.
     * Stores the resulting JWT for subsequent requests.
     */
    agentToken(credentials: AgentTokenRequest): Promise<OneclawResponse<TokenResponse>>;
    /**
     * Authenticate with a user API key (prefix `ocv_`).
     * Stores the resulting JWT for subsequent requests.
     */
    apiKeyToken(credentials: UserApiKeyTokenRequest): Promise<OneclawResponse<TokenResponse>>;
    /**
     * Authenticate with a Google ID token (OAuth2 flow).
     * Stores the resulting JWT for subsequent requests.
     */
    google(credentials: GoogleAuthRequest): Promise<OneclawResponse<TokenResponse>>;
    /** Change the current user's password. */
    changePassword(request: ChangePasswordRequest): Promise<OneclawResponse<void>>;
    /**
     * Set a password for a platform_oidc user (no current password required).
     * Only works when the user has never set a password before.
     */
    setPassword(request: {
        password: string;
        password_confirm: string;
    }): Promise<OneclawResponse<{
        message: string;
    }>>;
    /**
     * Request an email change. Sends a verification code to the new email.
     */
    changeEmail(request: {
        new_email: string;
    }): Promise<OneclawResponse<{
        message: string;
        new_email: string;
        expires_in_seconds: number;
    }>>;
    /**
     * Verify an email change with the code sent to the new address.
     */
    verifyEmailChange(request: {
        code: string;
    }): Promise<OneclawResponse<{
        message: string;
        email: string;
    }>>;
    /**
     * Request a password reset email (email/password accounts only).
     * Always returns a generic success message (no email enumeration).
     */
    forgotPassword(request: ForgotPasswordRequest): Promise<OneclawResponse<ForgotPasswordResponse>>;
    /** Complete password reset using the token from the email. */
    resetPassword(request: ResetPasswordRequest): Promise<OneclawResponse<ResetPasswordResponse>>;
    /** Revoke the current session token. */
    logout(): Promise<OneclawResponse<void>>;
    /** Get the current user's profile. */
    getMe(): Promise<OneclawResponse<UserProfileResponse>>;
    /** Update the current user's profile (display name, marketing opt-in). */
    updateMe(update: UpdateProfileRequest): Promise<OneclawResponse<UserProfileResponse>>;
    /** Delete the current user's account and all associated data. */
    deleteMe(request: DeleteAccountRequest, confirm?: string): Promise<OneclawResponse<void>>;
    /** Export the current user's personal data (GDPR/data-portability). */
    exportData(confirm?: string): Promise<OneclawResponse<ExportDataResponse>>;
    /**
     * Exchange a 1claw subject token for a short-lived OIDC federation JWT
     * (RFC 8693). The returned `access_token` is signed with RS256 and is
     * meant for external relying parties such as Anthropic Workload Identity
     * Federation, GCP STS, AWS STS, etc.
     *
     * If `subjectToken` is omitted, the SDK uses the current client token.
     * The agent must have `federation_enabled = true` and the `audience`
     * must be on its `federation_audiences` allowlist.
     */
    exchangeFederatedToken(request: TokenExchangeRequest): Promise<OneclawResponse<TokenExchangeResponse>>;
    /** Send a one-time passcode to an email address (no auth required). */
    sendEmailOtp(params: EmailOtpSendRequest): Promise<OneclawResponse<EmailOtpSendResponse>>;
    /**
     * Verify an email OTP code. Returns a JWT on success.
     * Stores the resulting token for subsequent requests.
     */
    verifyEmailOtp(params: EmailOtpVerifyRequest): Promise<OneclawResponse<EmailOtpVerifyResponse>>;
    /**
     * Authenticate via a social provider (Google, Apple, Discord).
     * Stores the resulting JWT for subsequent requests.
     */
    socialLogin(params: SocialLoginRequest): Promise<OneclawResponse<SocialLoginResponse>>;
    /** Exchange an OAuth authorization code for tokens (supports PKCE via `code_verifier`). */
    exchangeOAuthCode(params: OAuthTokenRequest): Promise<OneclawResponse<OAuthTokenResponse>>;
    /**
     * Revoke an OAuth access or refresh token (RFC 7009).
     * The token is invalidated immediately and can no longer be used.
     */
    revokeToken(params: OAuthRevokeRequest): Promise<OneclawResponse<OAuthRevokeResponse>>;
    /**
     * Revoke OAuth consent for a specific platform app.
     * All active tokens issued to the app are invalidated and the consent record is removed.
     */
    revokeConsent(appId: string): Promise<OneclawResponse<OAuthConsentRevokeResponse>>;
    /**
     * Fetch the authenticated user's profile from the OAuth userinfo endpoint.
     *
     * @param accessToken - Bearer token obtained from `exchangeOAuthCode()`.
     *   Uses the client's current token when omitted.
     */
    getUserInfo(accessToken?: string): Promise<OneclawResponse<UserInfoResponse>>;
    /** Get effective human factor auth policy for treasury wallet actions. */
    getHumanFactorAuth(): Promise<OneclawResponse<{
        policy: Record<string, unknown>;
        source: string;
    }>>;
    /** Set user-level human factor auth policy. */
    setHumanFactorAuth(policy: Record<string, unknown>): Promise<OneclawResponse<{
        policy: Record<string, unknown>;
        source: string;
    }>>;
}
//# sourceMappingURL=auth.d.ts.map