import { e as OAuthConfig, A as AuthHttpOptions, f as OAuthTokens, c as ContentstackUser, C as ContentstackCredentials, a as ContentstackCredentialsSession } from '../types-CoUR6CJM.cjs';
export { b as ContentstackOAuthScope, O as OAUTH_SCOPE_DESCRIPTIONS, d as OAUTH_SCOPE_PRESETS } from '../types-CoUR6CJM.cjs';
import { ContentstackRegion } from '../regions/index.cjs';
import '../types-C8x5GGVP.cjs';

interface AuthorizationUrlOptions {
    state?: string;
    usePKCE?: boolean;
}
interface AuthorizationUrlResult {
    url: string;
    state: string;
    codeVerifier?: string;
}
interface ExchangeCodeOptions {
    codeVerifier?: string;
    httpOptions?: AuthHttpOptions;
}
/**
 * Build a Contentstack OAuth authorization URL.
 *
 * @example
 * ```ts
 * const { url, state, codeVerifier } = await buildAuthorizationUrl({
 *   region: "us",
 *   appId: "app-uid",
 *   clientId: "client-id",
 *   clientSecret: "secret",
 *   scopes: ["user:read"],
 *   redirectUri: "http://localhost:3000/api/auth/callback/contentstack",
 * }, { usePKCE: true })
 * ```
 */
declare function buildAuthorizationUrl(config: OAuthConfig, options?: AuthorizationUrlOptions): Promise<AuthorizationUrlResult>;
/**
 * Exchange an authorization code for OAuth tokens.
 */
declare function exchangeCode(config: OAuthConfig, code: string, options?: ExchangeCodeOptions): Promise<OAuthTokens>;
/**
 * Refresh an expired access token using a refresh token.
 */
declare function refreshToken(config: OAuthConfig, token: string, options?: {
    httpOptions?: AuthHttpOptions;
}): Promise<OAuthTokens>;
interface AppTokenCredentials {
    clientId: string;
    clientSecret: string;
}
/**
 * Obtain an app token (client credentials grant) for machine-to-machine integrations.
 * Requires the app's `app_token_config` to be enabled with the needed scopes.
 */
declare function exchangeAppToken(region: ContentstackRegion, credentials: AppTokenCredentials, options?: {
    httpOptions?: AuthHttpOptions;
}): Promise<OAuthTokens>;
/**
 * Fetch the authenticated user's profile from Contentstack.
 * Unwraps the nested `user` key and maps snake_case → camelCase.
 */
declare function getUser(region: ContentstackRegion, accessToken: string, options?: {
    httpOptions?: AuthHttpOptions;
}): Promise<ContentstackUser>;
/**
 * Create an Auth.js v5 provider config object for Contentstack.
 *
 * No Auth.js dependency is required in this package — the returned object
 * conforms to the Auth.js OAuthConfig shape and can be passed directly to
 * `next-auth` or `@auth/core`.
 *
 * @example
 * ```ts
 * // app/api/auth/[...nextauth]/route.ts
 * import NextAuth from "next-auth"
 * import { createAuthProvider } from "@timbenniks/contentstack-platform-sdk/auth"
 *
 * export const { handlers, signIn, signOut, auth } = NextAuth({
 *   providers: [createAuthProvider({ region: "us", appId: "...", ... })],
 * })
 * ```
 */
declare function createAuthProvider(config: OAuthConfig): Record<string, unknown>;
/**
 * Create Auth.js v5 callbacks for token persistence and automatic refresh.
 *
 * The `jwt` callback persists OAuth tokens on initial sign-in and attempts
 * to refresh expired tokens (with a 60-second safety window).
 *
 * The `session` callback exposes the access token and any refresh errors
 * on the session object.
 *
 * @example
 * ```ts
 * import NextAuth from "next-auth"
 * import { createAuthProvider, contentstackAuthCallbacks } from "@timbenniks/contentstack-platform-sdk/auth"
 *
 * export const { handlers, auth } = NextAuth({
 *   providers: [createAuthProvider({ ... })],
 *   callbacks: contentstackAuthCallbacks({ region: "us", ... }),
 * })
 * ```
 */
declare function contentstackAuthCallbacks(config: OAuthConfig): {
    jwt({ token, account, }: {
        token: Record<string, unknown>;
        account?: Record<string, unknown> | null;
    }): Promise<Record<string, unknown>>;
    session({ session, token, }: {
        session: Record<string, unknown>;
        token: Record<string, unknown>;
    }): Promise<Record<string, unknown>>;
};

type SessionAuth = {
    type: "oauth";
    accessToken: string;
} | {
    type: "authtoken";
    token: string;
};
declare function loginWithCredentials(region: ContentstackRegion, credentials: ContentstackCredentials, options?: {
    httpOptions?: AuthHttpOptions;
}): Promise<ContentstackCredentialsSession>;
declare function logoutUserSession(region: ContentstackRegion, authtoken: string, options?: {
    httpOptions?: AuthHttpOptions;
}): Promise<void>;
declare function getCurrentUser(region: ContentstackRegion, auth: SessionAuth, options?: {
    httpOptions?: AuthHttpOptions;
}): Promise<ContentstackUser>;

/**
 * Generate a cryptographically random code verifier for PKCE.
 * Returns a 43-character URL-safe string (the minimum length per RFC 7636).
 * Uses globalThis.crypto for cross-runtime compatibility (Node 18+, Deno, Bun, edge).
 */
declare function generateCodeVerifier(): string;
/**
 * Compute an S256 code challenge from a code verifier.
 * SHA-256 hash → base64url encoded (no padding).
 * Uses globalThis.crypto.subtle for cross-runtime compatibility.
 */
declare function generateCodeChallenge(verifier: string): Promise<string>;

export { type AppTokenCredentials, AuthHttpOptions, ContentstackCredentials, ContentstackCredentialsSession, ContentstackUser, OAuthConfig, OAuthTokens, buildAuthorizationUrl, contentstackAuthCallbacks, createAuthProvider, exchangeAppToken, exchangeCode, generateCodeChallenge, generateCodeVerifier, getCurrentUser, getUser, loginWithCredentials, logoutUserSession, refreshToken };