import { ApproveMembershipRequestResult, AuthResult, GetProjectMembersOptions, IdpProvider, McpOAuthProjectMemberContext, McpScope, McpTokenPayload, OAuthAuthorizationCode, OAuthAuthorizationRequest, OAuthJwksResult, OAuthTokenExchangeRequest, OAuthTokenExchangeResult, Payload, Project, ProjectMember, ProjectMemberInvitation, ProjectMembershipRequest, Projects, RequestProjectAccessResult, Role, UserProvisioningRequestAccessContext } from '@owox/idp-protocol';
import type { CreateNewProjectResult, UserProvisioningSettings, UserProvisioningSettingsUpdate } from '@owox/idp-protocol';
import e, { Express, NextFunction } from 'express';
import type { BetterAuthProviderConfig } from './config/index.js';
/**
 * Main IdP implementation that wires core PKCE flow and Better Auth.
 */
export declare class OwoxBetterAuthIdp implements IdpProvider {
    private readonly config;
    private readonly magicLinkService;
    private readonly auth;
    private readonly store;
    private readonly betterAuthProxyHandler;
    private readonly authErrorController;
    private readonly pageController;
    private readonly passwordFlowController;
    private readonly googleSheetsAuthController;
    private readonly betterAuthSessionService;
    private readonly authFlowMiddleware;
    private readonly identityClient;
    private readonly logger;
    private readonly tokenFacade;
    private readonly userContextService;
    private readonly userAuthInfoPersistenceService;
    private readonly platformAuthFlowClient;
    private readonly pkceFlowOrchestrator;
    private readonly projectMembersService;
    private readonly membershipRequestsService;
    private readonly onboardingService;
    private readonly onboardingController;
    private constructor();
    getProjectMembers(projectId: string, options?: GetProjectMembersOptions): Promise<ProjectMember[]>;
    inviteMember(projectId: string, email: string, role: Role, actorUserId: string): Promise<ProjectMemberInvitation>;
    removeMember(projectId: string, userId: string, actorUserId: string): Promise<void>;
    changeMemberRole(projectId: string, userId: string, newRole: Role, actorUserId: string): Promise<void>;
    getUserProvisioningSettings(projectId: string, actorUserId: string): Promise<UserProvisioningSettings>;
    updateUserProvisioningSettings(projectId: string, actorUserId: string, settings: UserProvisioningSettingsUpdate): Promise<UserProvisioningSettings>;
    listMembershipRequests(projectId: string, actorUserId: string, _options?: {
        forceFresh?: boolean;
    }): Promise<ProjectMembershipRequest[]>;
    approveMembershipRequest(projectId: string, requestId: string, role: Role, actorUserId: string): Promise<ApproveMembershipRequestResult>;
    declineMembershipRequest(projectId: string, requestId: string, actorUserId: string): Promise<void>;
    getUserProvisioningRequestAccessContext(userId: string, projectId: string): Promise<UserProvisioningRequestAccessContext>;
    requestProjectAccess(userId: string, projectId: string, role: Role): Promise<RequestProjectAccessResult>;
    createNewProject(userId: string, integration: string): Promise<CreateNewProjectResult>;
    static create(config: BetterAuthProviderConfig): Promise<OwoxBetterAuthIdp>;
    initialize(): Promise<void>;
    registerRoutes(app: Express): void;
    signInMiddleware(req: e.Request, res: e.Response, next: NextFunction): Promise<void | e.Response>;
    /**
     * Handles sign-in when no query state is present.
     * Attempts fast-path IDP start or refresh token reuse, otherwise redirects to platform.
     */
    private handleNoState;
    private hasOAuthAuthorizeContinuation;
    /**
     * Attempts to use an existing refresh token for silent re-authentication.
     * Returns true if the user was redirected, false if the token was invalid.
     */
    private handleExistingRefreshToken;
    private resolveExistingRefreshRedirect;
    signUpMiddleware(req: e.Request, res: e.Response, _next: NextFunction): Promise<void | e.Response>;
    signOutMiddleware(req: e.Request, res: e.Response, _next: NextFunction): Promise<void | e.Response>;
    userApiMiddleware(req: e.Request, res: e.Response, _next: NextFunction): Promise<e.Response<Payload>>;
    projectsApiMiddleware(req: e.Request, res: e.Response, _next: NextFunction): Promise<e.Response<Projects>>;
    getProjects(accessToken: string): Promise<Projects>;
    getProjectForUser(userId: string, projectId: string): Promise<Project>;
    introspectToken(token: string): Promise<Payload | null>;
    parseToken(token: string): Promise<Payload | null>;
    verifyToken(token: string): Promise<Payload | null>;
    private resolveMcpServerUrl;
    refreshToken(refreshToken: string): Promise<AuthResult>;
    issueAccessTokenForProjectMemberApiKey(apiKeyId: string, userId: string, projectId: string, role: Role | null, readOnly: boolean): Promise<AuthResult>;
    issueAccessTokenForPluginRuntime(pluginId: string, installationId: string, userId: string, projectId: string): Promise<AuthResult>;
    createMcpOAuthAuthorizationCode(request: OAuthAuthorizationRequest, projectMember: McpOAuthProjectMemberContext): Promise<OAuthAuthorizationCode>;
    exchangeMcpOAuthToken(request: OAuthTokenExchangeRequest): Promise<OAuthTokenExchangeResult>;
    verifyMcpAccessToken(token: string, resource: string, requiredScopes: McpScope[]): Promise<McpTokenPayload | null>;
    getMcpOAuthJwks(): Promise<OAuthJwksResult>;
    revokeToken(token: string): Promise<void>;
    /**
     * Best-effort revocation of the OWOX platform refresh token carried by the
     * current request (the `refreshToken` cookie), then clears that cookie.
     *
     * Used after a password reset so the platform session tied to THIS request
     * is invalidated at the OWOX Identity level — not only the Better Auth UI
     * session. Revocation failures are non-fatal (logged, not thrown) so they
     * never block completing the password flow.
     *
     * Scope note: this revokes the platform token carried by the request. Broader
     * multi-device platform-session revocation is handled by the OWOX Identity
     * service and tracked separately.
     */
    private revokePlatformRefreshTokenFromRequest;
    accessTokenMiddleware(req: e.Request, res: e.Response, _next: NextFunction): Promise<void | e.Response>;
    shutdown(): Promise<void>;
    isHealthy(): Promise<boolean>;
    private redirectToPlatform;
}
//# sourceMappingURL=owox-better-auth-idp.d.ts.map