import type { EnvironmentName } from '@nevermined-io/payments';
/**
 * The network the embed app resolves its active backend from. The embed
 * app reads `?network=` on mount and defaults to `sandbox` when absent
 * (it never decodes the session token to infer it), so a CLI flow that
 * omits this lands a live-minted session on the sandbox backend and
 * fails. We always forward it explicitly. See issue #362.
 */
export type EmbedNetwork = 'sandbox' | 'live';
/**
 * Map a CLI environment name to the embed app's `network` value. The
 * `embed` origin is shared across the sandbox/live pair within a tier
 * (`embed.nevermined.app` for both `sandbox` and `live`), differentiated
 * only by the backend the session is validated against — so the embed
 * app cannot infer the network from the origin and we must pass it.
 *
 * `custom` has no fixed tier, so we sniff `NVM_BACKEND_URL`: a backend
 * host containing `live` selects `live`, otherwise we fall back to
 * `sandbox` (matching the embed app's own default).
 *
 * NOTE: `live` is only matched as a dot/slash-bounded segment (the
 * `api.live.<host>` convention), so a hyphenated host like
 * `https://api-live.example.com` would fall through to `sandbox`. That's
 * intentional given the naming convention; a `custom` deployment that
 * doesn't follow it should set `NVM_BACKEND_URL` to a conforming host.
 */
export declare function resolveEmbedNetwork(environment: EnvironmentName): EmbedNetwork;
export interface WidgetRedirectFlowOptions {
    /** Embed app base URL — e.g. `Environments[env].embed` (`embed.<tier>`). */
    embedUrl: string;
    /**
     * Relative path on the embed app the CLI wants to open, e.g.
     * `/cards/setup` or `/cards/enroll`.
     */
    embedPath: string;
    /**
     * Embed-app network (`sandbox` / `live`). Forwarded as `?network=` so
     * the embed app validates the session against the matching backend —
     * derive it from the active environment via `resolveEmbedNetwork`.
     * Required: omitting it lets live flows silently hit sandbox (#362).
     */
    network: EmbedNetwork;
    /**
     * Called once the local callback server is listening, with the bound
     * `returnUrl`. The caller mints a widget session against that URL and
     * returns the resulting `sessionToken`. Splitting it this way lets
     * the backend validate `returnUrl` at session-creation time (the
     * spec'd contract) — minting before the port is known would leave
     * the backend's pre-flight allow-list check with no URL to verify.
     */
    mintSession: (args: {
        returnUrl: string;
    }) => Promise<{
        sessionToken: string;
    }>;
    /** Extra query params to forward to the embed page (e.g. `provider=stripe`, `paymentMethodId=pm_x`). */
    extraSearchParams?: Record<string, string>;
    /** If true, prints the URL instead of opening the browser. */
    noBrowser?: boolean;
    /** Caller-supplied logger / printer. The login command uses oclif's formatter; this is the same shape. */
    log: (msg: string) => void;
    /** Suggested success-page wording — keeps the wording aligned with whichever command is calling. */
    successPageTitle?: string;
    /** Suggested timeout-error wording — keeps it specific to the calling command instead of "Card setup ..." for everything. */
    timeoutMessage?: string;
}
export interface WidgetRedirectFlowResult {
    /** Echoed `state` value — the helper has already verified it matches. */
    state: string;
    /** All query params the embed page redirected with (paymentMethodId, delegationId, …). */
    query: Record<string, string>;
}
/**
 * Shared redirect-mode handshake for any CLI command that hands the user
 * off to a `/cards/*` page on the standalone embed app (`embed.<tier>`)
 * and waits for a localhost callback.
 *
 * Flow:
 *   1. Bind a one-shot HTTP server on `127.0.0.1:0` (the OS picks a free port).
 *   2. Compute `returnUrl = http://127.0.0.1:<port>/callback` and hand it
 *      to `opts.mintSession`. The caller mints a widget session bound to
 *      that exact returnUrl (which the backend can validate against the
 *      session-specific allow-list at creation time). We use the literal
 *      `127.0.0.1` rather than `localhost` because the server binds to
 *      `127.0.0.1` and Node 17+ resolves `localhost` to `::1` first on
 *      modern hosts — the browser would stall on the IPv6 attempt before
 *      falling back to IPv4.
 *   3. Open the browser at `{embed}/<path>?sessionToken=…&returnUrl=…&state=<rand>`.
 *   4. Resolve when the embed page redirects to `/callback?…&state=<echo>`.
 *      `state` is compared in constant time.
 *
 * Rejects on bind failure, mint failure, 5-minute timeout, or
 * state-mismatched callback (the bad request gets a styled error page
 * and the server stays alive — the legitimate callback can still land).
 */
export declare function runWidgetRedirectFlow(opts: WidgetRedirectFlowOptions): Promise<WidgetRedirectFlowResult>;
/**
 * POST to the `/widgets/session/self` endpoint with the caller's NVM
 * API key. Lives here (not in the SDK) because v1 only wires this up
 * for the CLI redirect flow — when the SDK exposes
 * `payments.widgets.createSelfSession()` we can swap this for the SDK
 * call without touching command callers.
 */
export interface SelfMintSessionResponse {
    sessionToken: string;
    userId: string;
    userWallet: string;
    apiKeyHash: string;
    expiresAt: string;
    isReturnUrlAllowed?: boolean | null;
}
export declare function mintSelfWidgetSession(args: {
    backendUrl: string;
    nvmApiKey: string;
    orgId: string;
    returnUrl?: string;
}): Promise<SelfMintSessionResponse>;
//# sourceMappingURL=widget-redirect-flow.d.ts.map