export { handlePopupCallback, isPopupCallback } from './popup-callback.mjs';

/**
 * Authway client configuration
 */
interface AuthwayConfig {
    /**
     * Auth Backend URL (e.g., 'http://localhost:8081' or 'https://auth.authway.example.com')
     * This is the Auth Backend server that proxies API calls to Central API and handles CORS.
     *
     * For local development:
     * - Use 'http://localhost:8081' (Auth Backend - recommended for SPAs)
     * - Auth Backend proxies API calls to Central API (port 8080) and provides CORS support
     *
     * OAuth server (Hydra) is auto-detected from this URL (port 8080/8081 → 4444)
     */
    domain: string;
    /**
     * OAuth 2.0 client ID
     */
    clientId: string;
    /**
     * OAuth server URL (advanced usage only)
     * Auto-detected from domain for most cases
     * For local dev: domain with :8080 or :8081 → auto-changed to :4444 for Hydra
     * Only override this if you have a custom OAuth server setup
     * @default auto-detected from domain
     */
    oauthServerUrl?: string;
    /**
     * Central API URL (advanced usage only)
     * Explicitly specify the Central API URL if different from domain
     * @deprecated Use 'domain' instead - this will be removed in future versions
     * @default same as domain
     */
    authwayUrl?: string;
    /**
     * Redirect URI after authentication
     * @default window.location.origin
     */
    redirectUri?: string;
    /**
     * API audience identifier
     */
    audience?: string;
    /**
     * OAuth scopes
     * @default 'openid profile email'
     */
    scope?: string;
    /**
     * Enable refresh tokens
     * @default true
     */
    useRefreshTokens?: boolean;
    /**
     * Token cache location
     * - 'memory': Most secure, tokens lost on page refresh
     * - 'localstorage': Persistent, vulnerable to XSS
     * @default 'memory'
     */
    cacheLocation?: 'memory' | 'localstorage';
    /**
     * Tenant ID for multi-tenant mode
     */
    tenantId?: string;
    /**
     * Enable dynamic claims support
     * @default true
     */
    enableDynamicClaims?: boolean;
    /**
     * Auto-sync claims interval (milliseconds)
     * Set to 0 to disable
     * @default 0
     */
    claimsUpdateInterval?: number;
    /**
     * Custom token leeway for expiration checks (seconds)
     * @default 60
     */
    leeway?: number;
    /**
     * Maximum token age for silent refresh (seconds)
     * @default 86400 (24 hours)
     */
    maxAge?: number;
    /**
     * Enable DPoP (Demonstrating Proof-of-Possession) RFC 9449
     * Adds an extra layer of security by binding tokens to a cryptographic key
     * @default false
     */
    useDPoP?: boolean;
}
/**
 * Normalized configuration with defaults applied
 */
interface NormalizedConfig extends Required<Omit<AuthwayConfig, 'audience' | 'tenantId' | 'authwayUrl' | 'oauthServerUrl'>> {
    oauthServerUrl: string;
    centralApiUrl: string;
    audience?: string;
    tenantId?: string;
    /** @deprecated Use centralApiUrl instead */
    authwayUrl: string;
}

/**
 * User profile from ID token
 */
interface User {
    /**
     * Subject identifier (user ID)
     */
    sub: string;
    /**
     * Email address
     */
    email: string;
    /**
     * Email verification status
     */
    email_verified: boolean;
    /**
     * Full name
     */
    name?: string;
    /**
     * Given name (first name)
     */
    given_name?: string;
    /**
     * Family name (last name)
     */
    family_name?: string;
    /**
     * Profile picture URL
     */
    picture?: string;
    /**
     * Locale
     */
    locale?: string;
    /**
     * Timezone
     */
    zoneinfo?: string;
    /**
     * Updated timestamp
     */
    updated_at?: number;
    /**
     * Additional custom claims
     */
    [key: string]: any;
}
/**
 * User claims (custom and standard)
 */
interface Claims {
    /**
     * User roles
     */
    roles?: string[];
    /**
     * User permissions
     */
    permissions?: string[];
    /**
     * Tenant ID (example - can be used for multi-tenancy)
     */
    tenant_id?: string;
    /**
     * Custom claims - add any custom data here
     * Examples: workspace_id, organization_id, project_id, etc.
     */
    [key: string]: any;
}
/**
 * Linked identity (connected account)
 * Similar to Auth0's Identity structure
 */
interface Identity {
    /**
     * Identity provider (e.g., 'google', 'github', 'email')
     */
    provider: string;
    /**
     * User ID from the provider
     */
    user_id: string;
    /**
     * Connection name
     */
    connection?: string;
    /**
     * Whether this is the primary identity
     */
    is_social: boolean;
    /**
     * Profile data from provider
     */
    profile_data?: {
        email?: string;
        email_verified?: boolean;
        name?: string;
        picture?: string;
        [key: string]: any;
    };
}
/**
 * Options for linking accounts
 */
interface LinkAccountOptions {
    /**
     * Provider to link (e.g., 'google', 'github')
     */
    provider: string;
    /**
     * Optional connection name
     */
    connection?: string;
    /**
     * Redirect URI after linking
     */
    redirectUri?: string;
}

/**
 * OAuth redirect login options
 */
interface RedirectLoginOptions {
    /**
     * OAuth connection/provider (e.g., 'google')
     */
    connection?: string;
    /**
     * Screen hint ('login' or 'signup')
     */
    screen_hint?: 'login' | 'signup';
    /**
     * UI locales
     */
    ui_locales?: string;
    /**
     * Application state to preserve
     */
    appState?: any;
    /**
     * Custom redirect URI for this request
     */
    redirectUri?: string;
    /**
     * Additional query parameters
     */
    [key: string]: any;
}
/**
 * Password credentials for direct login
 */
interface PasswordCredentials {
    email: string;
    password: string;
    tenantId?: string;
}
/**
 * Popup login options
 */
interface PopupLoginOptions {
    connection?: string;
    screen_hint?: 'login' | 'signup';
    ui_locales?: string;
    /**
     * Custom redirect URI for this request
     */
    redirectUri?: string;
    /**
     * Additional query parameters
     */
    [key: string]: any;
}
/**
 * Logout options
 */
interface LogoutOptions {
    /**
     * URL to redirect after logout
     */
    returnTo?: string;
    /**
     * Federated logout (logout from identity provider)
     */
    federated?: boolean;
    /**
     * Local logout only (don't redirect)
     */
    localOnly?: boolean;
}
/**
 * Authentication result
 */
interface AuthResult {
    accessToken: string;
    idToken: string;
    refreshToken?: string;
    expiresIn: number;
    user: User;
}
/**
 * Redirect callback result
 */
interface RedirectLoginResult extends AuthResult {
    appState?: any;
}
/**
 * Token claims (JWT payload)
 */
interface TokenClaims {
    iss: string;
    sub: string;
    aud: string | string[];
    exp: number;
    iat: number;
    azp?: string;
    scope?: string;
    [key: string]: any;
}
/**
 * Get token options
 */
interface GetTokenOptions {
    /**
     * Force token refresh even if not expired
     */
    ignoreCache?: boolean;
    /**
     * Custom audience for this token request
     */
    audience?: string;
    /**
     * Custom scope for this token request
     */
    scope?: string;
    /**
     * Timeout for the request (milliseconds)
     */
    timeoutInSeconds?: number;
}
/**
 * Session state
 */
interface SessionState {
    isAuthenticated: boolean;
    user: User | null;
    accessToken: string | null;
    idToken: string | null;
    expiresAt: number | null;
}
/**
 * PKCE challenge
 */
interface PKCEChallenge {
    codeVerifier: string;
    codeChallenge: string;
    state: string;
    nonce: string;
}

/**
 * Base Authway error
 */
declare class AuthwayError extends Error {
    code: string;
    statusCode?: number | undefined;
    constructor(message: string, code: string, statusCode?: number | undefined);
}
/**
 * Configuration error
 */
declare class ConfigurationError extends AuthwayError {
    constructor(message: string);
}
/**
 * Network/API error
 */
declare class ApiError extends AuthwayError {
    response?: any | undefined;
    constructor(message: string, statusCode: number, response?: any | undefined);
}
/**
 * Authentication error
 */
declare class AuthenticationError extends AuthwayError {
    constructor(message: string, code?: string);
}
/**
 * Token error
 */
declare class TokenError extends AuthwayError {
    constructor(message: string, code?: string);
}
/**
 * Timeout error
 */
declare class TimeoutError extends AuthwayError {
    constructor(message?: string);
}
/**
 * Missing refresh token error
 */
declare class MissingRefreshTokenError extends TokenError {
    constructor();
}
/**
 * Login required error
 */
declare class LoginRequiredError extends AuthenticationError {
    constructor(message?: string);
}
/**
 * Popup timeout error
 */
declare class PopupTimeoutError extends AuthwayError {
    popup: Window | null;
    constructor(message?: string, popup?: Window | null);
    toJSON(): {
        name: string;
        message: string;
        code: string;
        statusCode: number | undefined;
    };
}
/**
 * Popup cancelled error
 */
declare class PopupCancelledError extends AuthwayError {
    popup: Window | null;
    constructor(message?: string, popup?: Window | null);
    toJSON(): {
        name: string;
        message: string;
        code: string;
    };
}

/**
 * Main Authway authentication client
 */
declare class AuthwayClient {
    private config;
    private storage;
    private sessionStorage;
    private tokenRefreshTimer?;
    private dpopKeyPair;
    private cache;
    private configReady;
    /**
     * Static method to handle popup callback context.
     * Call this before creating AuthwayClient to check if running in a popup.
     * If in popup context with OAuth params, sends postMessage and closes window.
     *
     * @returns true if popup callback was handled (window will close), false otherwise
     */
    static handlePopupCallback(): boolean;
    constructor(config: AuthwayConfig);
    /**
     * Wait for client to be ready (config loaded)
     */
    waitForReady(): Promise<void>;
    /**
     * Initialize DPoP key pair
     */
    private initializeDPoP;
    private normalizeConfig;
    /**
     * Fetch remote configuration from Central API
     * Allows dynamic discovery of OAuth server and other endpoints
     */
    private fetchRemoteConfig;
    /**
     * Redirect to Authway hosted login
     */
    loginWithRedirect(options?: RedirectLoginOptions): Promise<void>;
    /**
     * Handle OAuth callback
     */
    handleRedirectCallback(url?: string): Promise<RedirectLoginResult>;
    /**
     * Login with password (custom UI)
     */
    loginWithPassword(credentials: PasswordCredentials): Promise<AuthResult>;
    /**
     * Login with popup - opens login UI in popup window
     * User remains on the app, popup closes automatically after auth
     */
    loginWithPopup(options?: PopupLoginOptions): Promise<AuthResult>;
    /**
     * Logout
     */
    logout(options?: LogoutOptions): void;
    /**
     * Get valid access token (auto-refresh if needed)
     */
    getAccessToken(options?: GetTokenOptions): Promise<string>;
    /**
     * Get access token with popup
     * Opens a popup to get a new access token (useful when refresh token is not available)
     * Similar to Auth0's getAccessTokenWithPopup()
     */
    getAccessTokenWithPopup(options?: PopupLoginOptions): Promise<string>;
    /**
     * Get ID token
     */
    getIdToken(): Promise<string>;
    /**
     * Refresh tokens
     */
    refreshTokens(): Promise<void>;
    /**
     * Get current user
     */
    getUser(): Promise<User | null>;
    /**
     * Get ID token claims
     * Similar to Auth0's getIdTokenClaims()
     *
     * @returns The decoded ID token payload
     */
    getIdTokenClaims(): Promise<any | null>;
    /**
     * Get user claims (combines system claims from ID token + dynamic claims from backend)
     */
    getClaims(): Promise<Claims>;
    /**
     * Update dynamic claims
     * Note: Claims updates require re-authentication to take effect
     * This method will automatically redirect to re-authenticate
     */
    updateClaims(claims: Partial<Claims>): Promise<void>;
    /**
     * Update user-level claims (NO re-authentication required)
     * Use this for user preferences, metadata, custom data
     */
    updateUserClaims(claims: Partial<Claims>): Promise<void>;
    /**
     * Get user-level claims (claim_type='user')
     */
    getUserClaims(): Promise<Claims>;
    /**
     * Get linked accounts (identities)
     * Similar to Auth0's getUser() with identities field
     */
    getLinkedAccounts(): Promise<Identity[]>;
    /**
     * Link a new account (identity)
     * Opens a popup to authenticate with another provider and link it
     * Similar to Auth0's linkWithPopup()
     */
    linkAccount(options: LinkAccountOptions): Promise<Identity>;
    /**
     * Unlink an account (identity)
     * Similar to Auth0's unlinkUser()
     */
    unlinkAccount(provider: string, userId: string): Promise<void>;
    /**
     * Check if authenticated
     */
    isAuthenticated(): Promise<boolean>;
    /**
     * Check session (silent authentication)
     */
    checkSession(): Promise<AuthResult | null>;
    /**
     * Get session state
     */
    getSessionState(): SessionState;
    private buildAuthorizationUrl;
    private buildLogoutUrl;
    private exchangeCodeForTokens;
    private saveTokens;
    private clearTokens;
    private loadFromStorage;
    private scheduleTokenRefresh;
}

export { ApiError, type AuthResult, AuthenticationError, AuthwayClient, type AuthwayConfig, AuthwayError, type Claims, ConfigurationError, type GetTokenOptions, type Identity, type LinkAccountOptions, LoginRequiredError, type LogoutOptions, MissingRefreshTokenError, type NormalizedConfig, type PKCEChallenge, type PasswordCredentials, PopupCancelledError, type PopupLoginOptions, PopupTimeoutError, type RedirectLoginOptions, type RedirectLoginResult, type SessionState, TimeoutError, type TokenClaims, TokenError, type User };