/* tslint:disable */
/* eslint-disable */
/**
 * The `ReadableStreamType` enum.
 *
 * *This API requires the following crate features to be activated: `ReadableStreamType`*
 */

type ReadableStreamType = "bytes";

export class AccessKeyStrategy {
    private constructor();
    free(): void;
    [Symbol.dispose](): void;
    /**
     * Create a new `AccessKeyStrategy` for the given workspace CRN and
     * access key. Region is derived from the CRN — there's no separate
     * region argument — so the strategy can't be configured for one
     * workspace's region while the CRN says another.
     *
     * Every issued token's workspace claim is verified against the CRN;
     * a mismatch fails the call with a `WORKSPACE_MISMATCH` error.
     */
    static create(workspace_crn: string, access_key: string): AccessKeyStrategy;
    /**
     * Create an `AccessKeyStrategy` backed by external token-store callbacks.
     *
     * `loadToken` is called on cold start before any HTTP request fires; it
     * must return the previously-saved JSON string (or null/undefined for
     * "cache miss") wrapped in a Promise. `saveToken` receives the JSON
     * string after every successful refresh and must persist it; its return
     * Promise resolves to undefined.
     *
     * Use this to back the strategy with HTTP-only cookies (Supabase Edge),
     * KV stores (Cloudflare Workers), or any other request-scoped cache.
     */
    static createWithStore(workspace_crn: string, access_key: string, load_token: Function, save_token: Function): AccessKeyStrategy;
    /**
     * Retrieve a valid access token, refreshing or re-authenticating as needed.
     */
    getToken(): Promise<any>;
}

export class IntoUnderlyingByteSource {
    private constructor();
    free(): void;
    [Symbol.dispose](): void;
    cancel(): void;
    pull(controller: ReadableByteStreamController): Promise<any>;
    start(controller: ReadableByteStreamController): void;
    readonly autoAllocateChunkSize: number;
    readonly type: ReadableStreamType;
}

export class IntoUnderlyingSink {
    private constructor();
    free(): void;
    [Symbol.dispose](): void;
    abort(reason: any): Promise<any>;
    close(): Promise<any>;
    write(chunk: any): Promise<any>;
}

export class IntoUnderlyingSource {
    private constructor();
    free(): void;
    [Symbol.dispose](): void;
    cancel(): void;
    pull(controller: ReadableStreamDefaultController): Promise<any>;
}

/**
 * Federates a third-party OIDC JWT (Clerk, Supabase, …) into a CTS service
 * token. See the crate-level docs and `stack_auth::OidcFederationStrategy`.
 */
export class OidcFederationStrategy {
    private constructor();
    free(): void;
    [Symbol.dispose](): void;
    /**
     * Create an `OidcFederationStrategy` for the given workspace CRN.
     *
     * The CRN format is `crn:<region>:<workspace-id>` (e.g.
     * `"crn:ap-southeast-2.aws:ZVATKW3VHMFG27DY"`). Region is parsed from
     * the CRN and used for service discovery; the workspace ID is used to
     * verify every federated token belongs to the right workspace.
     *
     * `getJwt` is called on every federation — initial auth and every
     * re-federation after expiry — and must return `Promise<string>`
     * resolving to the *current* third-party OIDC JWT (e.g. by calling
     * `clerk.session.getToken()`).
     *
     * `baseUrl`, when supplied, pins this strategy to a specific CTS host —
     * e.g. a self-hosted CTS or a local mock auth server. It overrides region
     * service discovery and is scoped to this strategy alone. In wasm there is
     * no `CS_CTS_HOST` env fallback (the sandbox can't read env), so `baseUrl`
     * is the only way to target a host other than the region-discovered one.
     */
    static create(workspace_crn: string, get_jwt: Function, base_url?: string | null): OidcFederationStrategy;
    /**
     * Create an `OidcFederationStrategy` backed by external token-store callbacks.
     *
     * Behaves like `create` but persists the federated CTS
     * token through `loadToken` / `saveToken` — see
     * [`AccessKeyStrategy::create_with_store`] for the callback contract. Use
     * this to back the strategy with an HTTP-only cookie so a federated token
     * survives across Edge Function invocations without re-federating.
     *
     * `baseUrl` behaves as in `create` — an explicit,
     * strategy-scoped CTS host that overrides region service discovery.
     */
    static createWithStore(workspace_crn: string, get_jwt: Function, load_token: Function, save_token: Function, base_url?: string | null): OidcFederationStrategy;
    /**
     * Retrieve a valid CTS service token, federating or re-federating as needed.
     */
    getToken(): Promise<any>;
}

/**
 * Route Rust panics to `console.error` with a readable message + stack.
 * Without this, panics surface as opaque `RuntimeError: unreachable` from
 * wasm bytecode offsets.
 */
export function module_init(): void;