import type { AuthConfig } from './config.js';
/**
 * A uniform façade over Arctic's providers.
 *
 * Arctic's provider classes have deliberately different signatures — Google and Entra take a PKCE
 * verifier, GitHub does not; Entra's constructor takes a tenant first. Normalising here means the
 * route handlers have one code path instead of a switch, and adding a provider later touches only
 * this file.
 */
export type OAuthProviderName = 'google' | 'github' | 'microsoft';
export interface OAuthProfile {
    providerUserId: string;
    email: string;
    name: string;
    avatarUrl: string | null;
}
export interface AuthorizationRequest {
    url: URL;
    state: string;
    /** Absent for providers that do not use PKCE (GitHub). */
    codeVerifier?: string;
}
export interface OAuthProvider {
    name: OAuthProviderName;
    createAuthorization(): AuthorizationRequest;
    fetchProfile(code: string, codeVerifier?: string): Promise<OAuthProfile>;
}
export declare function getConfiguredProviders(config: AuthConfig): OAuthProviderName[];
export declare function createOAuthProvider(config: AuthConfig, name: OAuthProviderName): OAuthProvider | undefined;
export declare class OAuthProfileError extends Error {
    name: string;
}