import { Client, FetchHandler } from '@atcute/client';
import { Nsid, AtprotoDid, AtprotoAudience } from '@atcute/lexicons/syntax';
import { S as ServiceOAuthScope } from './service-auth-contract-CER8k0ek.js';

interface PublicServiceClientOptions {
    /** Canonical public Contrail HTTPS origin. */
    endpoint: string;
    /** Existing authenticated AT Protocol client used to mint service tokens.
     *  Omit when the consumer only needs anonymous methods. */
    authenticatedClient?: Client;
    /** Base receiving-service DID from the verified provider contract. Null and
     *  an omitted value both mean the provider serves no protected methods. */
    serviceDid?: AtprotoDid | null;
    /** Exact fragmented OAuth and JWT audience from the provider contract. */
    serviceAudience?: AtprotoAudience | null;
    /** Exact least-privilege OAuth permission from the provider contract. */
    scope?: ServiceOAuthScope | null;
    /** XRPC methods granted by the exact OAuth permission. */
    protectedMethods?: readonly Nsid[] | null;
    /** Exact XRPC methods served by this provider. Supplying the verified list
     *  lets authenticated clients route all other methods to the user's PDS. */
    serviceMethods?: readonly Nsid[];
    /** Record collections whose successful PDS writes should notify Contrail. */
    collections?: readonly Nsid[];
    /** Protected notification procedure advertised by the provider. */
    notifyMethod?: Nsid;
    /** Browser, test, or instrumented fetch implementation. */
    fetch?: typeof globalThis.fetch;
    /** Permit plain HTTP only on a loopback host for local development. */
    allowInsecureHttp?: boolean;
}
interface PublicServiceNotificationErrorContext {
    method: Nsid;
    uris: readonly string[];
}
interface PublicServiceAuthenticatedOptions {
    onNotificationError?: (error: unknown, context: PublicServiceNotificationErrorContext) => void;
}
type PublicServiceClient = Client & {
    /** Canonical public Contrail origin. */
    readonly endpoint: string;
    /** OAuth permission required by protected methods, or null when unconfigured. */
    readonly scope: ServiceOAuthScope | null;
    /** Record collections whose successful writes trigger notification. */
    readonly collections: readonly Nsid[];
    /** Combine this provider with an authenticated PDS client. Provider methods
     *  route to Contrail; other methods route to the PDS; successful tracked
     *  record writes notify Contrail before returning their original response. */
    authenticated(authenticatedClient: Client, options?: PublicServiceAuthenticatedOptions): PublicServiceClient;
};
declare function publicServiceOAuthScope(audience: AtprotoAudience, protectedMethods: readonly Nsid[]): ServiceOAuthScope;
/** Fetch handler that keeps anonymous reads direct while automatically
 * discovering service auth and minting, caching, and attaching method-bound AT
 * Protocol service tokens after a protected route challenges the first request. */
declare function publicServiceFetchHandler(options: PublicServiceClientOptions): FetchHandler;
/** Create a typed Atcute client for anonymous and service-auth Contrail methods.
 *  Generated Lexicon imports still supply the method-specific TypeScript API. */
declare function createPublicServiceClient(options: PublicServiceClientOptions & {
    serviceDid: AtprotoDid;
    serviceAudience: AtprotoAudience;
    scope: ServiceOAuthScope;
    protectedMethods: readonly Nsid[];
}): PublicServiceClient & {
    readonly scope: ServiceOAuthScope;
};
declare function createPublicServiceClient(options: PublicServiceClientOptions): PublicServiceClient;

export { type PublicServiceAuthenticatedOptions, type PublicServiceClient, type PublicServiceClientOptions, type PublicServiceNotificationErrorContext, createPublicServiceClient, publicServiceFetchHandler, publicServiceOAuthScope };