import type { TokenSet } from "./tokenResponse";
import { type TokenStore } from "./tokenStore";
/** Options for `authorize`. */
export interface AuthorizeOptions {
    /** Issuer URL the OIDC discovery document advertises (e.g. `${serverURL}/realms/${realm}` for Keycloak). */
    issuerURL: string;
    /** OAuth client ID registered with the authorization server. */
    clientId: string;
    /** Persisted alongside the tokens so future verbs can re-discover `/api/sso-config` without flags. */
    walnutURL: string;
    /** OAuth scopes to request. Keycloak callers typically pass `["offline_access"]` for a refresh token. */
    scopes: readonly string[];
    /** Max time to wait for the loopback callback, in milliseconds. */
    timeoutMs?: number;
    /** Aborts the in-flight discovery, callback wait, and token exchange. */
    signal?: AbortSignal;
    /** Override for the token persistence layer. */
    tokenStore?: TokenStore;
    /** Override for the system browser launcher. Injected for tests. */
    openBrowser?: (url: string) => void;
    /** Called with the authorization URL just before the browser launch. Default prints to stderr only when stderr is a TTY. */
    onAuthorizationURL?: (url: string) => void;
    /**
     * Called for soft warnings (e.g. requested `offline_access` but the
     * server returned no refresh token, or the browser failed to
     * launch). Default prints to stderr only when stderr is a TTY.
     * Non-TTY callers who want warning visibility should pass an
     * explicit handler — dropped warnings have no symptom at the time
     * they fire; users discover the consequence later.
     */
    onWarning?: (message: string) => void;
    /** Forwarded to discovery; permits non-loopback http issuers + endpoints. */
    allowInsecureIssuer?: boolean;
}
/**
 * Runs the full OAuth 2.0 Authorization Code + PKCE flow (RFC 6749 +
 * RFC 7636): discovery, PKCE + state generation, loopback callback
 * server, browser launch, code → token exchange, and keychain
 * persistence.
 *
 * Note on identity: this library uses the OIDC discovery well-known
 * path as a convention (most OAuth 2.0 providers expose it) but does
 * *not* perform OIDC-strength identity validation — no id_token
 * parsing, nonce checks, or JWKS signature verification. Callers
 * needing authenticated identity claims should layer that on top.
 *
 * @returns The `TokenSet` on success. Also persisted via `tokenStore`.
 *   `refreshToken` will be absent if the requested scopes did not
 *   include `offline_access` (or the provider's equivalent).
 * @throws {OAuthFlowError} For discovery, token-exchange, or keychain failures.
 * @throws {OAuthCallbackError} For loopback/callback-server failures.
 */
export declare function authorize(options: AuthorizeOptions): Promise<TokenSet>;