import { QelosSDKOptions } from './types';
import BaseSDK from './base-sdk';
export interface IUser {
    _id: string;
    username: string;
    email: string;
    phone?: string;
    fullName: string;
    firstName: string;
    lastName: string;
    birthDate: string;
    roles: string[];
    metadata: any;
    [key: string]: any;
}
export interface ICredentials {
    username: string;
    password: string;
    roles?: string[];
}
export interface BasicPayload {
    user: IUser;
}
export interface ISignupInformation {
    username: string;
    email?: string;
    phone?: string;
    password: string;
    fullName?: string;
    firstName: string;
    lastName: string;
    birthDate: string;
}
export interface IApiToken {
    _id: string;
    nickname: string;
    tokenPrefix: string;
    expiresAt: string;
    lastUsedAt?: string;
    /** Workspace scope when set; may be an id string or a populated `{ _id, name }` from list responses */
    workspace?: string | {
        _id: string;
        name?: string;
    } | null;
    /** Successful API-token authentications (server-maintained). */
    usageCount?: number;
    created: string;
}
export type SocialProvider = 'linkedin' | 'facebook' | 'google' | 'github';
export interface SocialLoginOptions {
    state?: string;
    /**
     * Where Qelos redirects after OAuth with `?rt=<refreshToken>` (SDK flow).
     * Absolute URLs must use a host listed in app-configuration `metadata.websiteUrls`.
     */
    returnUrl?: string;
    /**
     * Overrides the OAuth provider callback origin when its host is listed in
     * app-configuration `metadata.websiteUrls`. The callback path stays
     * `/api/auth/<provider>/callback` on that origin. When omitted, Qelos uses
     * the request tenant host (`tenanthost`).
     */
    redirectUrl?: string;
}
export interface SocialAuthCallbackPayload {
    payload: BasicPayload & {
        workspace?: any;
    };
    headers: {
        'set-cookie': string | null;
    };
    /**
     * Present when the runtime exposes multiple `Set-Cookie` headers (Node fetch
     * `getSetCookie()`). Use {@link getSocialAuthSetCookieParts} to apply cookies.
     */
    setCookieHeaders?: string[];
}
/** Callback URL or query bag carrying `rt` from `GET …/callback?rt=…`. */
export type SocialCallbackInput = string | URL | URLSearchParams | Record<string, string | string[] | undefined>;
/**
 * Read the OAuth refresh token from a social callback request (query `rt`).
 * Accepts a full URL, a {@link URL}, `URLSearchParams`, or a query object such
 * as `req.query` from Next.js or Express.
 */
export declare function parseSocialCallbackRefreshToken(input: SocialCallbackInput): string | undefined;
/** Lists individual `Set-Cookie` values from an exchange result for writing to a response. */
export declare function getSocialAuthSetCookieParts(result: SocialAuthCallbackPayload): string[];
/**
 * Copies session cookies from {@link QlAuthentication.exchangeAuthCallback} /
 * {@link QlAuthentication.socialCallback} onto an HTTP response (Express,
 * Next.js Pages `NextApiResponse`, Node `ServerResponse`, etc.).
 */
export declare function applySocialAuthCookiesToServerResponse(res: {
    setHeader(name: string, value: string | string[]): void;
}, result: SocialAuthCallbackPayload): void;
export default class QlAuthentication extends BaseSDK {
    #private;
    get accessToken(): string;
    get isApiTokenAuth(): boolean;
    constructor(options: QelosSDKOptions);
    signin(credentials: ICredentials): Promise<{
        headers: {
            'set-cookie': string;
        };
        payload: BasicPayload;
    }>;
    oAuthSignin(credentials: ICredentials): Promise<{
        payload: BasicPayload & {
            token: string;
            refreshToken: string;
        };
    }>;
    signup(information: ISignupInformation): Promise<{
        payload: BasicPayload;
    }>;
    oAuthSignup(information: ISignupInformation): Promise<{
        payload: BasicPayload & {
            token: string;
            refreshToken: string;
        };
    }>;
    refreshToken(refreshToken?: string): Promise<{
        payload: BasicPayload & {
            token: string;
            refreshToken: string;
        };
    }>;
    refreshCookieToken(cookieToken?: string): Promise<{
        headers: {
            'set-cookie': string;
        };
        payload: BasicPayload & {
            cookieToken: string;
            workspace?: {
                _id: string;
            } | null;
        };
    }>;
    apiTokenSignin(apiToken: string): Promise<IUser>;
    listApiTokens(): Promise<IApiToken[]>;
    createApiToken(data: {
        nickname: string;
        workspace?: string;
        expiresAt: string;
    }): Promise<{
        token: string;
        apiToken: IApiToken;
    }>;
    deleteApiToken(tokenId: string): Promise<void>;
    logout(): Promise<Response>;
    getSocialLoginUrl(provider: SocialProvider, options?: SocialLoginOptions): string;
    getSocialCallbackUrl(provider: SocialProvider): string;
    startSocialLogin(provider: SocialProvider, options?: SocialLoginOptions): void;
    exchangeAuthCallback(refreshToken: string): Promise<SocialAuthCallbackPayload>;
    /**
     * Full social callback: read `rt` from the request URL or query and exchange
     * it for a session. Use with integrator routes that receive the provider
     * callback with `?rt=` (refresh token) after OAuth.
     */
    socialCallback(input: SocialCallbackInput): Promise<SocialAuthCallbackPayload>;
    getLoggedInUser(): Promise<IUser>;
    updateLoggedInUser(changes: Partial<IUser & {
        password?: string;
    }>): Promise<IUser>;
}