import type * as Corti from "../../api/index.js";
import { AuthClient } from "../../api/resources/auth/client/Client.js";
import type { OAuthAuthProvider } from "../../auth/OAuthAuthProvider.js";
import * as core from "../../core/index.js";
import { type Environment } from "../utils/environment.js";
interface Options {
    skipRedirect?: boolean;
}
export declare namespace CortiAuth {
    /** Auth (clientId/clientSecret or token) is optional; credentials can be passed to getToken() instead. */
    type Options = Omit<AuthClient.Options, "clientId" | "clientSecret" | "token" | "environment"> & Partial<OAuthAuthProvider.ClientCredentials> & Partial<OAuthAuthProvider.TokenOverride> & {
        environment: Environment;
    };
    /** Optional scopes on getToken request. */
    interface GetTokenRequest extends Corti.OAuthTokenRequest {
        scopes?: string[];
    }
    /** ROPC (resource owner password credentials) request for getRopcFlowToken. */
    interface GetRopcFlowTokenRequest {
        clientId: string;
        username: string;
        password: string;
        scopes?: string[];
    }
    /** Refresh token request for refreshToken. */
    interface RefreshTokenRequest {
        clientId: string;
        refreshToken: string;
        clientSecret?: string;
        scopes?: string[];
    }
    /** Authorization code grant request for getCodeFlowToken. */
    interface GetCodeFlowTokenRequest {
        clientId: string;
        clientSecret: string;
        redirectUri: string;
        code: string;
        scopes?: string[];
    }
    /** PKCE grant request for getPkceFlowToken. codeVerifier is optional — if omitted, reads from localStorage. */
    interface GetPkceFlowTokenRequest {
        clientId: string;
        redirectUri: string;
        code: string;
        codeVerifier?: string;
        scopes?: string[];
    }
    /**
     * Auth shapes used by `CortiClient` when passing `auth: ...`.
     */
    type AuthClientCredentials = {
        clientId: string;
        clientSecret: string;
    };
    type AuthRopc = Omit<GetRopcFlowTokenRequest, "scopes">;
    type AuthCode = Omit<GetCodeFlowTokenRequest, "scopes">;
    type AuthPkce = Omit<GetPkceFlowTokenRequest, "scopes">;
    type AuthTokenDerivable = {
        accessToken: string;
        refreshAccessToken?: OAuthAuthProvider.RefreshAccessTokenFunction;
        expiresIn?: number;
        refreshToken?: string;
        refreshExpiresIn?: number;
        clientId?: string;
    } | {
        refreshAccessToken: OAuthAuthProvider.RefreshAccessTokenFunction;
        accessToken?: string;
        expiresIn?: number;
        refreshToken?: string;
        refreshExpiresIn?: number;
        clientId?: string;
    };
    type AuthServer = AuthClientCredentials | AuthRopc | AuthCode | AuthPkce;
    /** Parameters for authorizeURL — builds the Keycloak authorization endpoint URL. */
    interface AuthorizationCodeClient {
        clientId: string;
        redirectUri: string;
        codeChallenge?: string;
        scopes?: string[];
    }
    /** Parameters for authorizePkceUrl — like AuthorizationCodeClient but without codeChallenge (generated internally). */
    interface PkceClient {
        clientId: string;
        redirectUri: string;
        scopes?: string[];
        codeVerifier?: string;
    }
}
export declare class CortiAuth extends AuthClient {
    private readonly _tenantName;
    /** No-op auth provider so super.token() does not trigger OAuth refresh. When auth is omitted, a dummy token is passed so the base constructor does not throw. */
    constructor(options: CortiAuth.Options);
    /**
     * Exchange credentials for a short-lived access token using the tenant token endpoint (client_credentials).
     * Resolves tenant from client options. Supports optional scopes (openid is always included).
     *
     * @param request - Client credentials and optional scopes
     * @param requestOptions - Request-specific configuration
     *
     * @throws {@link Corti.BadRequestError}
     * @throws {@link Corti.UnauthorizedError}
     *
     * @example
     *     const response = await auth.getToken({
     *         clientId: "client_id",
     *         clientSecret: "client_secret",
     *         scopes: ["profile"]
     *     });
     */
    getToken(request: CortiAuth.GetTokenRequest, requestOptions?: AuthClient.RequestOptions): core.HttpResponsePromise<Corti.AuthTokenResponse>;
    private _getTokenWithTenant;
    /** Exchange username/password for access token via ROPC (resource owner password credentials). */
    getRopcFlowToken(request: CortiAuth.GetRopcFlowTokenRequest, requestOptions?: AuthClient.RequestOptions): core.HttpResponsePromise<Corti.AuthTokenResponse>;
    /**
     * Exchange a refresh token for a new access token (refresh_token grant).
     * Resolves tenant from client options.
     *
     * @param request - Client ID, refresh token, and optional scopes
     * @param requestOptions - Request-specific configuration
     *
     * @throws {@link Corti.BadRequestError}
     * @throws {@link Corti.UnauthorizedError}
     *
     * @example
     *     const response = await auth.refreshToken({
     *         clientId: "client_id",
     *         refreshToken: "refresh_token",
     *     });
     */
    refreshToken(request: CortiAuth.RefreshTokenRequest, requestOptions?: AuthClient.RequestOptions): core.HttpResponsePromise<Corti.AuthTokenResponse>;
    /** Exchange an authorization code for an access token (authorization_code grant). */
    getCodeFlowToken(request: CortiAuth.GetCodeFlowTokenRequest, requestOptions?: AuthClient.RequestOptions): core.HttpResponsePromise<Corti.AuthTokenResponse>;
    /**
     * Exchange a PKCE authorization code for an access token (authorization_code grant with code_verifier).
     * If codeVerifier is omitted, it is read from localStorage (set by authorizePkceUrl).
     */
    getPkceFlowToken(request: CortiAuth.GetPkceFlowTokenRequest, requestOptions?: AuthClient.RequestOptions): core.HttpResponsePromise<Corti.AuthTokenResponse>;
    /**
     * Build the Keycloak authorization endpoint URL for the PKCE flow.
     * Generates a code verifier if not provided, stores it in localStorage, and computes the challenge.
     * In a browser environment, redirects to the URL unless skipRedirect is true.
     */
    authorizePkceUrl({ clientId, redirectUri, scopes, codeVerifier }: CortiAuth.PkceClient, options?: Options): Promise<string>;
    /** Read the PKCE code verifier stored in localStorage by authorizePkceUrl. Returns null if not found. */
    static getCodeVerifier(): string | null;
    /**
     * Build the Keycloak authorization endpoint URL for the authorization code flow.
     * In a browser environment, redirects to the URL unless skipRedirect is true.
     * In a server environment (no window), always returns the URL string.
     *
     * @param client - clientId, redirectUri, and optional codeChallenge/scopes
     * @param options - { skipRedirect?: boolean }
     */
    authorizeURL({ clientId, redirectUri, codeChallenge, scopes }: CortiAuth.AuthorizationCodeClient, options?: Options): Promise<string>;
}
export {};