import type * as Corti from "../../api/index.js";
import type { BaseClientOptions } from "../../BaseClient.js";
import * as core from "../../core/index.js";
import { CLIENT_ID_PARAM, CLIENT_SECRET_PARAM, CODE_PARAM, CODE_VERIFIER_PARAM, PASSWORD_PARAM, REDIRECT_URI_PARAM, USERNAME_PARAM } from "../utils/oauthAuthHelpers.js";
/** Patch: Re-export for consumers; implementation shared with OAuthRopcAuthProvider, OAuthAuthCodeAuthProvider and OAuthPkceAuthProvider. */
export { BUFFER_IN_MINUTES, CLIENT_ID_PARAM, CLIENT_ID_REQUIRED_ERROR_MESSAGE, CLIENT_SECRET_PARAM, CLIENT_SECRET_REQUIRED_ERROR_MESSAGE, CODE_PARAM, CODE_VERIFIER_PARAM, getExpiresAt, PASSWORD_PARAM, PASSWORD_REQUIRED_ERROR_MESSAGE, REDIRECT_URI_PARAM, USERNAME_PARAM, USERNAME_REQUIRED_ERROR_MESSAGE, } from "../utils/oauthAuthHelpers.js";
declare const TOKEN_PARAM: "token";
export declare class OAuthAuthProvider implements core.AuthProvider {
    private readonly options;
    /**
     * Patch: Use CortiAuth (real token endpoint) instead of AuthClient (fake-token).
     */
    private readonly authClient;
    private accessToken;
    private expiresAt;
    private refreshPromise;
    private storedRefreshToken;
    private refreshExpiresAt;
    constructor(options: OAuthAuthProvider.Options & OAuthAuthProvider.ClientCredentials);
    static canCreate(options?: Partial<OAuthAuthProvider.ClientCredentials & BaseClientOptions>): boolean;
    private clientIdSupplier;
    private clientSecretSupplier;
    getAuthRequest({ endpointMetadata, }?: {
        endpointMetadata?: core.EndpointMetadata;
    }): Promise<core.AuthRequest>;
    private getToken;
    private refresh;
}
export declare class OAuthTokenOverrideAuthProvider implements core.AuthProvider {
    private readonly authClient;
    private readonly _tokenSupplier;
    private readonly _clientIdSupplier;
    private readonly _refreshAccessToken;
    private accessToken;
    private expiresAt;
    private storedRefreshToken;
    private refreshExpiresAt;
    private _seedPromise;
    constructor(options: OAuthAuthProvider.TokenOverride & BaseClientOptions);
    static canCreate(options?: Partial<OAuthAuthProvider.TokenOverride & BaseClientOptions>): options is OAuthAuthProvider.TokenOverride & BaseClientOptions;
    getAuthRequest({ endpointMetadata, }?: {
        endpointMetadata?: core.EndpointMetadata;
    }): Promise<core.AuthRequest>;
}
export declare namespace OAuthAuthProvider {
    const AUTH_SCHEME: "OAuth";
    /** Patch: Message extended to mention ROPC (clientId, username, password). */
    const AUTH_CONFIG_ERROR_MESSAGE: string;
    type ClientCredentials = {
        [CLIENT_ID_PARAM]: core.Supplier<string>;
        [CLIENT_SECRET_PARAM]: core.Supplier<string>;
    };
    /**
     * Patch: tokenType and expiresIn made optional — the provider only strictly needs accessToken.
     * Mirrors AuthTokenResponse but relaxes the two required fields so custom refresh functions
     * don't need to return fields the provider doesn't use.
     */
    type ExpectedTokenResponse = Omit<Corti.AuthTokenResponse, "tokenType" | "expiresIn"> & {
        tokenType?: string;
        expiresIn?: number;
    };
    /** Patch: Custom refresh function — sync or async, receives the last known refresh token. */
    type RefreshAccessTokenFunction = (refreshToken?: string) => Promise<OAuthAuthProvider.ExpectedTokenResponse> | OAuthAuthProvider.ExpectedTokenResponse;
    type TokenOverride = {
        [TOKEN_PARAM]?: core.Supplier<string>;
        /** Patch: Custom callback called to obtain/renew the access token. Takes priority over built-in clientId+refreshToken path. */
        refreshAccessToken?: OAuthAuthProvider.RefreshAccessTokenFunction;
        expiresIn?: number;
        refreshToken?: string;
        refreshExpiresIn?: number;
        clientId?: core.Supplier<string>;
        /** Patch: Pre-seeded token response from resolveClientOptions — avoids a second refreshAccessToken call on first API request. */
        initialTokenResponse?: Promise<OAuthAuthProvider.ExpectedTokenResponse>;
    };
    /** Patch: ROPC grant credentials (clientId + username + password) */
    type RopcCredentials = {
        [CLIENT_ID_PARAM]: core.Supplier<string>;
        [USERNAME_PARAM]: core.Supplier<string>;
        [PASSWORD_PARAM]: core.Supplier<string>;
    };
    /** Patch: Authorization code credentials (clientId + clientSecret + code + redirectUri) */
    type AuthCodeCredentials = {
        [CLIENT_ID_PARAM]: core.Supplier<string>;
        [CLIENT_SECRET_PARAM]: core.Supplier<string>;
        [CODE_PARAM]: core.Supplier<string>;
        [REDIRECT_URI_PARAM]: core.Supplier<string>;
    };
    /** Patch: PKCE credentials (clientId + code + redirectUri; no clientSecret) */
    type PkceCredentials = {
        [CLIENT_ID_PARAM]: core.Supplier<string>;
        [CODE_PARAM]: core.Supplier<string>;
        [REDIRECT_URI_PARAM]: core.Supplier<string>;
        [CODE_VERIFIER_PARAM]?: core.Supplier<string>;
    };
    /** Patch: Include RopcCredentials, AuthCodeCredentials and PkceCredentials so CortiClient can use those auth flows. */
    type AuthOptions = ClientCredentials | TokenOverride | RopcCredentials | AuthCodeCredentials | PkceCredentials;
    type Options = BaseClientOptions & AuthOptions;
    function createInstance(options: Options): core.AuthProvider;
}