/* tslint:disable */
/* eslint-disable */

/* auto-generated by NAPI-RS */

/**
 * The result of a successful `getToken()` call.
 *
 * Contains the bearer credential and decoded JWT claims for service discovery.
 */
export interface TokenResult {
  /** The bearer token string (used as `Authorization: Bearer <token>`). */
  token: string
  /** The subject claim from the JWT (e.g. `"CS|auth0|user123"` or `"CS|CSAKkeyId"`). */
  subject: string
  /** The workspace identifier from the JWT. */
  workspaceId: string
  /** The issuer URL from the JWT `iss` claim (i.e. the CTS host). */
  issuer: string
  /** Service endpoint URLs from the JWT `services` claim (e.g. `{ zerokms: "https://..." }`). */
  services: Record<string, string>
}
/** Options for `AutoStrategy.detect()`. */
export interface AutoStrategyOptions {
  /** An explicit access key (takes precedence over `CS_CLIENT_ACCESS_KEY` env var). */
  accessKey?: string
  /** An explicit workspace CRN (takes precedence over `CS_WORKSPACE_CRN` env var). */
  workspaceCrn?: string
}
/**
 * Metadata returned after a successful device code authentication.
 *
 * The actual token is never exposed to JavaScript — it is saved directly
 * to `~/.cipherstash/auth.json` by the Rust layer.
 */
export interface AuthResult {
  /** Absolute epoch timestamp (seconds) when the token expires. */
  expiresAt: number
  /** Number of seconds before the token expires (computed at time of return). */
  expiresIn: number
}
/**
 * Provision a device client in ZeroKMS after login.
 *
 * Loads the auth token and device identity from `~/.cipherstash/`,
 * creates a client on the workspace's default keyset, and persists the
 * resulting secret key to `~/.cipherstash/secretkey.json`.
 *
 * This is a no-op if the secret key already exists or the server returns
 * 409 (conflict).
 */
export declare function bindClientDevice(): Promise<void>
/** Begin the OAuth 2.0 Device Authorization flow. */
export declare function beginDeviceCodeFlow(region: string, clientId: string): Promise<DeviceCodeResult>
/**
 * An auth strategy that auto-detects credentials from environment variables
 * and the local profile store.
 *
 * Detection order:
 * 1. `CS_CLIENT_ACCESS_KEY` env var (or explicit `accessKey` option) → access key auth
 * 2. `~/.cipherstash/auth.json` → OAuth token auth
 * 3. Error: not authenticated
 */
export declare class AutoStrategy {
  /**
   * Detect available credentials and return an `AutoStrategy`.
   *
   * Pass options to provide explicit values that take precedence over
   * environment variables.
   */
  static detect(options?: AutoStrategyOptions | undefined | null): AutoStrategy
  /** Retrieve a valid access token, refreshing or re-authenticating as needed. */
  getToken(): Promise<TokenResult>
}
/**
 * An auth strategy that uses a static access key for service-to-service
 * or CI/CD authentication.
 */
export declare class AccessKeyStrategy {
  /**
   * Create a new `AccessKeyStrategy` for the given workspace CRN and
   * access key.
   *
   * The CRN format is `crn:<region>:<workspace-id>` (e.g.
   * `"crn:ap-southeast-2.aws:ZVATKW3VHMFG27DY"`). Region is parsed
   * from the CRN and used for service discovery; the workspace ID is
   * used to verify every issued token belongs to the right workspace.
   * A mismatch fails `getToken()` with `code === "WORKSPACE_MISMATCH"`.
   */
  static create(workspaceCrn: string, accessKey: string): AccessKeyStrategy
  /** Retrieve a valid access token, refreshing or re-authenticating as needed. */
  getToken(): Promise<TokenResult>
}
/**
 * An auth strategy that uses OAuth refresh tokens persisted to disk
 * (`~/.cipherstash/auth.json`).
 */
export declare class DeviceSessionStrategy {
  /** Load credentials from the default profile store and create a `DeviceSessionStrategy`. */
  static fromProfile(): DeviceSessionStrategy
  /** Retrieve a valid access token, refreshing as needed. */
  getToken(): Promise<TokenResult>
}
/**
 * An auth strategy that federates a third-party OIDC JWT (Clerk, Supabase, …)
 * into a CipherStash CTS service token via `/api/authorise`.
 */
export declare class OidcFederationStrategy {
  /**
   * Create an `OidcFederationStrategy` for the given workspace CRN.
   *
   * The CRN format is `crn:<region>:<workspace-id>` (e.g.
   * `"crn:ap-southeast-2.aws:ZVATKW3VHMFG27DY"`). Region is parsed from
   * the CRN and used for service discovery; the workspace ID is used to
   * verify every federated token belongs to the right workspace.
   *
   * `getJwt` is called on every federation — initial auth and every
   * re-federation after the CTS token expires — and must return
   * `Promise<string>` resolving to the *current* third-party OIDC JWT.
   *
   * `baseUrl`, when supplied, pins this strategy to a specific CTS host —
   * e.g. a self-hosted CTS or a local mock auth server. It takes precedence
   * over the `CS_CTS_HOST` environment variable and region service
   * discovery, and is scoped to this strategy alone (unlike `CS_CTS_HOST`,
   * which redirects every CTS client in the process).
   */
  static create(workspaceCrn: string, getJwt: () => any, baseUrl?: string | undefined | null): OidcFederationStrategy
  /**
   * Create an `OidcFederationStrategy` backed by external token-store callbacks.
   *
   * Behaves like `create` but persists the federated CTS
   * token through `loadToken` (`() => Promise<string | null | undefined>`)
   * and `saveToken` (`(json: string) => Promise<void>`) — e.g. an HTTP-only
   * cookie — so a federated token survives across requests without
   * re-federating.
   *
   * `baseUrl` behaves as in `create` — an explicit,
   * strategy-scoped CTS host that overrides `CS_CTS_HOST` and service
   * discovery.
   */
  static createWithStore(workspaceCrn: string, getJwt: () => any, loadToken: () => any, saveToken: (arg: string) => any, baseUrl?: string | undefined | null): OidcFederationStrategy
  /** Retrieve a valid CTS service token, federating or re-federating as needed. */
  getToken(): Promise<TokenResult>
}
export declare class DeviceCodeResult {
  get userCode(): string
  get verificationUri(): string
  get verificationUriComplete(): string
  get expiresIn(): number
  /**
   * Poll the auth server until the user completes authorization.
   *
   * **Consumes** the internal handle — it cannot be reused after this call.
   * If you need to open the browser, call `openInBrowser` *before*
   * `pollForToken`.
   */
  pollForToken(): Promise<AuthResult>
  /**
   * Open the verification URI in the user's default browser.
   *
   * Does **not** consume the handle — you can still call `pollForToken`
   * afterwards.
   */
  openInBrowser(): boolean
}