interface Token {
    readonly access_token: string;
    readonly expires_in: number;
    readonly refresh_token?: string;
    readonly expires_at: number;
}

type Events = {
    signIn: CustomEvent<Token>;
    signOut: Event;
    refresh: CustomEvent<Token>;
};
interface BaseOauthClient<K extends keyof Events & string> {
    (): Promise<string>;
    getTokenOrUndefined: () => string | undefined;
    signIn: () => Promise<Token>;
    signOut: () => Promise<void>;
    addEventListener: <T extends K>(type: T, listener: ((evt: Events[T]) => void) | null, options?: boolean | AddEventListenerOptions) => void;
    removeEventListener: <T extends K>(type: T, callback: ((evt: Events[T]) => void) | null, options?: EventListenerOptions | boolean) => void;
}

/**
 * Specifies where to store refresh tokens.
 *
 * - `'localStorage'`: Tokens persist across browser sessions. Best UX but vulnerable on shared devices without browser separation.
 * - `'sessionStorage'`: Tokens cleared when browser/tab closes. Recommended for shared devices.
 * - `'none'`: Tokens never stored. Users re-authenticate on every page load.
 */
type TokenStorageType = "localStorage" | "sessionStorage" | "none";

interface ConfidentialOauthClient extends BaseOauthClient<"signIn" | "signOut"> {
}

/**
 * Use this function to initialize an authless client that returns a public token.
 *
 * @returns A token provider function that returns a Promise resolving to a public token
 */
declare function createAuthlessClient(): () => Promise<string>;

/**
 * @param client_id
 * @param client_secret
 * @param url the base url of your foundry server
 * @param scopes
 * @param fetchFn
 * @param ctxPath
 * @returns which can be used as a token provider
 */
declare function createConfidentialOauthClient(client_id: string, client_secret: string, url: string, scopes?: string[], fetchFn?: typeof globalThis.fetch, ctxPath?: string): ConfidentialOauthClient;

interface OauthLogger {
    warn: (...args: any[]) => void;
}

interface PublicOauthClient extends BaseOauthClient<"signIn" | "signOut" | "refresh"> {
    refresh: () => Promise<Token | undefined>;
}

interface PublicOauthClientOptions {
    /**
     * If true, uses `history.replaceState()`, otherwise uses `window.location.assign()` (defaults to true)
     */
    useHistory?: boolean;
    /**
     * Custom landing page URL prior to logging in
     */
    loginPage?: string;
    /**
     * URL to return to after completed authentication cycle (defaults to `window.location.toString()`)
     */
    postLoginPage?: string;
    /**
     * * @param {string[]} [scopes=[]] - OAuth scopes to request. If not provided, defaults to `["api:read-data", "api:write-data", "api:use-ontologies-read", "api:use-ontologies-write"]`
     */
    scopes?: string[];
    /**
     * Custom fetch function to use for requests (defaults to `globalThis.fetch`)
     */
    fetchFn?: typeof globalThis.fetch;
    /**
     * Context path for the authorization server (defaults to "multipass")
     */
    ctxPath?: string;
    /**
     * Allows for an additional value to be appended to the local storage key for the refresh token.
     */
    refreshTokenMarker?: string;
    /**
     * Controls how refresh tokens are stored. Affects security vs. convenience tradeoff.
     *
     * - `'localStorage'` (default): Tokens persist across browser sessions.
     *   Best UX but vulnerable on shared devices.
     *
     * - `'sessionStorage'`: Tokens cleared when browser/tab closes.
     *   Recommended for shared devices. Users re-authenticate each browser session.
     *
     * - `'none'`: Tokens never stored. Users re-authenticate on every page load.
     *   Most secure but worst UX. Does not request `offline_access` scope.
     *
     * @default 'localStorage'
     */
    tokenStorage?: TokenStorageType;
    /**
     * Optional logger for warning messages. If not provided, warnings are silently dropped.
     * Structurally compatible with `@osdk/api`'s `Logger`.
     */
    logger?: OauthLogger;
}
/**
 * Creates a PublicOauthClient for authentication.
 *
 * @param {string} clientId - The client_id from the OAuth configuration on the server
 * @param {string} url - The base URL of your Foundry server
 * @param {string} redirectUrl - The URL configured for redirect in the OAuth configuration on the server
 * @param {PublicOauthClientOptions} options - Additional options for the client
 * @returns {PublicOauthClient} A client that can be used as a token provider
 */
declare function createPublicOauthClient(clientId: string, url: string, redirectUrl: string, options?: PublicOauthClientOptions): PublicOauthClient;
/**
 * Creates a PublicOauthClient for authentication.
 *
 * @param {string} clientId - The client_id from the OAuth configuration on the server
 * @param {string} url - The base URL of your Foundry server
 * @param {string} redirectUrl - The URL configured for redirect in the OAuth configuration on the server
 * @param {boolean} useHistory - If true, uses `history.replaceState()`, otherwise uses `window.location.assign()` (defaults to true)
 * @param {string} loginPage - Custom landing page URL prior to logging in
 * @param {string} postLoginPage - URL to return to after completed authentication cycle (defaults to `window.location.toString()`)
 * @param {string[]} scopes - OAuth scopes to request. If not provided, defaults to `["api:read-data", "api:write-data", "api:use-ontologies-read", "api:use-ontologies-write"]`
 * @param {typeof globalThis.fetch} fetchFn - Custom fetch function to use for requests (defaults to `globalThis.fetch`)
 * @param {string} ctxPath - Context path for the authorization server (defaults to "multipass")
 * @returns {PublicOauthClient} A client that can be used as a token provider
 */
declare function createPublicOauthClient(client_id: string, url: string, redirectUrl: string, useHistory?: boolean, loginPage?: string, postLoginPage?: string, scopes?: string[], fetchFn?: typeof globalThis.fetch, ctxPath?: string): PublicOauthClient;

export { type ConfidentialOauthClient, type OauthLogger, type PublicOauthClient, type PublicOauthClientOptions, type TokenStorageType, createAuthlessClient, createConfidentialOauthClient, createPublicOauthClient };