export { A as AuthManager, f as AuthStateListener, D as DEFAULT_API_URL, d as DEFAULT_CALLBACK_PATH, a as DEFAULT_OAUTH_SCOPES, g as getAllRoles, b as getAllowedOperations, h as hasPermission, c as hasRole } from './constants-C9ezX9zG.js';
import { OAuth2Tokens } from '@docyrus/api-client';
import { D as DocyrusAuthConfig, T as GuidyElementsMessage, W as GuidyRoutesMessage, U as GuidyPointAckMessage, G as GuidyRoute, Q as GuidyCommandMessage, c as AuthMode } from './types-BcLDyMdw.js';
export { A as AclOperation, a as AclTargetType, b as AdaptiveCard, x as AppNavigationRequestMessage, y as AppRouteChangeMessage, e as AuthStatus, C as CalendarSendAckMessage, z as CalendarSendMessage, B as ChatSendAckMessage, E as ChatSendMessage, F as DocySendAckMessage, I as DocySendMessage, f as DocyrusAclRule, g as DocyrusAuthContextValue, h as DocyrusCalendarEventPayload, i as DocyrusEmailPayload, J as DocyrusNotification, j as DocyrusPermission, k as DocyrusRole, l as DocyrusShareAdaptiveCardPayload, m as DocyrusSharePayload, n as DocyrusShareTextPayload, o as DocyrusUser, K as EmailSendAckMessage, L as EmailSendMessage, N as GuidyCommandHandler, S as GuidyElement, V as GuidyPointMessage, X as GuidyScanMessage, H as HostNavigationHandler, Y as HostNavigationMessage, w as HostNavigationRequestOptions, v as HostNotificationHandler, Z as HostNotificationMessage, _ as HostSignInMessage, $ as IframeAuth, M as MsGraphAccount, p as MsGraphClient, q as MsGraphRequest, a0 as MsGraphRequestMessage, r as MsGraphRequestOptions, s as MsGraphResponse, a1 as MsGraphResponseMessage, t as MsGraphStatus, a2 as MsGraphStatusRequestMessage, a3 as MsGraphStatusResponseMessage, P as PermissionConfig, u as PermissionScope, R as RouteChangePayload, a4 as TokenRefreshRequestMessage } from './types-BcLDyMdw.js';

/**
 * Standalone OAuth2 authorization code flow with PKCE via page redirect.
 * Wraps api-client's OAuth2Client and BrowserOAuth2TokenStorage.
 */
declare class StandaloneOAuth2Auth {
    private oauth2Client;
    private storage;
    private callbackPath;
    constructor(config?: DocyrusAuthConfig);
    /**
     * Check if the current page URL is the OAuth2 callback.
     * Called on app initialization to detect returning from the auth server.
     */
    isCallbackUrl(): boolean;
    /**
     * Initiate the OAuth2 authorization code flow.
     * Stores the current URL for post-auth redirect, then navigates
     * the page to the authorization endpoint.
     *
     * PKCE state (codeVerifier, state) is stored in localStorage
     * by the OAuth2Client and survives the page redirect.
     */
    initiateLogin(): Promise<void>;
    /**
     * Get the authorization URL without navigating.
     * Useful for Electron apps that open the URL in an external browser.
     * PKCE state is stored in storage just like initiateLogin().
     */
    getAuthorizationUrl(): Promise<string>;
    /**
     * Handle the OAuth2 callback URL.
     * Reads PKCE state from localStorage, validates the state param,
     * exchanges the authorization code for tokens, and stores them.
     */
    handleCallback(): Promise<OAuth2Tokens>;
    /**
     * Get the URL the user was on before the OAuth redirect.
     * Clears the stored value after retrieval.
     */
    getReturnUrl(): string | null;
    /** Get currently stored tokens (e.g., on page reload). */
    getStoredTokens(): Promise<OAuth2Tokens | null>;
    /** Persist externally obtained tokens for immediate authenticated use. */
    setTokens(tokens: OAuth2Tokens): Promise<void>;
    /** Check if the stored token is expired (with 60s buffer). */
    isTokenExpired(): Promise<boolean>;
    /** Refresh the access token using the stored refresh token. */
    refreshToken(): Promise<OAuth2Tokens>;
    /** Get a valid access token, refreshing if needed. */
    getValidAccessToken(): Promise<string>;
    /** Logout: revoke token and clear storage. */
    logout(): Promise<void>;
}

/** Post an app → host message (elements, routes, or a point ack). */
type GuidyBridgeSender = (message: GuidyElementsMessage | GuidyRoutesMessage | GuidyPointAckMessage) => void;
/**
 * Runs inside an embedded Docyrus app and lets the host assistant (Guidy)
 * inspect and drive the app's visible UI over the existing postMessage
 * channel.
 *
 * It only ever exposes labels/ids of already-visible interactive elements and
 * only executes a fixed command vocabulary (scan / point / click) — the same
 * exposure profile the host assistant already has on its own chrome. No
 * arbitrary script is accepted from the host.
 *
 * Protocol (paired with the host's ExternalAppManager):
 * - App → Host: `guidy:elements`   (pushed on start, route change, mutation)
 * - App → Host: `guidy:routes`     (pushed on start and when routes change)
 * - Host → App: `guidy:scan`       → app re-posts `guidy:elements` + `guidy:routes`
 * - Host → App: `guidy:point`      → app scrolls/highlights/(clicks), then
 * - App → Host: `guidy:point-ack`
 */
declare class GuidyBridge {
    private send;
    private routes;
    private started;
    private observer;
    private scanTimer;
    private routeListener;
    private highlightTimer;
    private clickTimer;
    private annotationTimer;
    constructor(send: GuidyBridgeSender, routes?: GuidyRoute[]);
    /** Replace the declared navigable routes and re-post them to the host. */
    setRoutes(routes: GuidyRoute[]): void;
    /**
     * Begin reporting the element inventory and watching for changes.
     * Idempotent. No-op outside a browser document.
     */
    start(): void;
    /** Stop watching and tear down any injected overlay. Idempotent. */
    stop(): void;
    /** Dispatch a host `guidy:*` command. Wired to `IframeAuth.onGuidyCommand`. */
    handleCommand(message: GuidyCommandMessage): void;
    /** Collect every visible anchor/button that exposes an id and a label. */
    private collectElements;
    private postElements;
    private postRoutes;
    private scheduleScan;
    private handlePoint;
    private ensureStyle;
    private highlight;
    private clearHighlight;
    private annotate;
    private clearAnnotation;
    private clearTimer;
}

/**
 * Detect whether the app is inside an iframe from a trusted *.docyrus.app host
 * or running as a standalone page.
 *
 * If we are in an iframe but NOT from a trusted origin, we fall back
 * to standalone mode (graceful degradation).
 */
declare function detectAuthMode(allowedOrigins?: string[], allowedPattern?: RegExp): AuthMode;

export { AuthMode, DocyrusAuthConfig, GuidyBridge, GuidyCommandMessage, GuidyElementsMessage, GuidyPointAckMessage, GuidyRoute, GuidyRoutesMessage, StandaloneOAuth2Auth, detectAuthMode };