import type { OAuthCredentials, OAuthProvider, OAuthProviderId, OAuthProviderInfo, OAuthProviderInterface } from "./types";
export type * from "./types";
/** Result returned by one OAuth device-code polling attempt. */
export type OAuthDeviceCodePollResult<T> = {
    status: "complete";
    value: T;
} | {
    status: "pending";
} | {
    status: "slow_down";
} | {
    status: "failed";
    message: string;
};
/** Options for polling an RFC 8628-style OAuth device-code flow. */
export interface OAuthDeviceCodeFlowOptions<T> {
    /** Poll the provider once and classify the response. */
    poll(): OAuthDeviceCodePollResult<T> | Promise<OAuthDeviceCodePollResult<T>>;
    /** Provider-requested polling cadence; defaults to RFC 8628's five seconds. */
    intervalSeconds?: number;
    /** Provider-issued expiry window for the device code. */
    expiresInSeconds?: number;
    /** Cancels the flow with the legacy "Login cancelled" error. */
    signal?: AbortSignal;
}
/** Poll an OAuth device-code flow until completion, provider failure, timeout, or cancellation. */
export declare function pollOAuthDeviceCodeFlow<T>(options: OAuthDeviceCodeFlowOptions<T>): Promise<T>;
/**
 * Register a custom OAuth provider.
 */
export declare function registerOAuthProvider(provider: OAuthProviderInterface): void;
/**
 * Get a custom OAuth provider by ID.
 */
export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
/**
 * Remove all custom OAuth providers registered by a source.
 */
export declare function unregisterOAuthProviders(sourceId: string): void;
/**
 * Refresh token for any OAuth provider.
 * Saves the new credentials and returns the new access token.
 */
export declare function refreshOAuthToken(provider: OAuthProvider, credentials: OAuthCredentials): Promise<OAuthCredentials>;
/**
 * Build API-key bytes for a provider from an already-fresh OAuth credential.
 *
 * Refresh is owned by AuthStorage. This helper deliberately refuses expired
 * credentials so it cannot POST broker redaction sentinels to upstream token
 * endpoints as a side channel.
 *
 * For providers that need credential metadata at request time, returns
 * JSON-encoded credentials plus expiry metadata for diagnostics/edge guards.
 * @returns API key string, or null if no credentials
 * @throws Error if the credential is expired and must be refreshed upstream
 */
export declare function getOAuthApiKey(provider: OAuthProvider, credentials: Record<string, OAuthCredentials>): Promise<{
    newCredentials: OAuthCredentials;
    apiKey: string;
} | null>;
/**
 * Get list of OAuth providers.
 */
export declare function getOAuthProviders(): OAuthProviderInfo[];