import type { OAuthCredentials, OAuthProvider, OAuthProviderId, OAuthProviderInfo, OAuthProviderInterface } from "./types";
/**
 * Register a custom OAuth provider.
 */
export declare function registerOAuthProvider(provider: OAuthProviderInterface): void;
/**
 * Get a custom OAuth provider by ID.
 */
export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
/**
 * Remove all custom OAuth providers registered by a source.
 */
export declare function unregisterOAuthProviders(sourceId: string): void;
/**
 * Refresh token for any OAuth provider.
 * Saves the new credentials and returns the new access token.
 */
export declare function refreshOAuthToken(provider: OAuthProvider, credentials: OAuthCredentials): Promise<OAuthCredentials>;
/**
 * Build API-key bytes for a provider from an already-fresh OAuth credential.
 *
 * Refresh is owned by AuthStorage. This helper deliberately refuses expired
 * credentials so it cannot POST broker redaction sentinels to upstream token
 * endpoints as a side channel.
 *
 * For providers that need credential metadata at request time, returns
 * JSON-encoded credentials plus expiry metadata for diagnostics/edge guards.
 * @returns API key string, or null if no credentials
 * @throws Error if the credential is expired and must be refreshed upstream
 */
export declare function getOAuthApiKey(provider: OAuthProvider, credentials: Record<string, OAuthCredentials>): Promise<{
    newCredentials: OAuthCredentials;
    apiKey: string;
} | null>;
export declare function resolveOAuthStorageProvider(provider: OAuthProviderId): OAuthProviderId;
/**
 * Get list of OAuth providers.
 */
export declare function getOAuthProviders(): OAuthProviderInfo[];