import { aiModelResource, aiProviderResource, credentialResource } from '@undefineds.co/models';
import type { EncryptedCredentialSecret } from '../credentials/KeyWrapper';
import type { CredentialVault, ProviderSecret } from '../credentials/CredentialVault';
import type { GatewayDeployment } from '../auth/InvocationTokenCodec';
import { type ProviderOfferingEndpointDescriptor, type ProviderCapabilities, type ProviderRegistry } from '../providers/ProviderRegistry';
import type { OfferingAuthorizationMethod } from '../providers/OfferingAuthorization';
import type { AuthContext } from '../../auth/AuthContext';
import type { InternalPodAccessTokenProvider } from '../pod/HostedPodDataAccess';
import { type PodBaseUrlResolver } from '../pod/PodBaseUrlResolver';
import type { AuthorizationCodeCallbackReceiver } from './LoopbackAuthorizationCallbackReceiver';
import type { AuthorizationCodeOAuthIntegration, DeviceCodeOAuthIntegration, OAuthConnectMode } from './DeviceCodeProtocol';
import type { LocalSessionImportAdapter } from './OpenAiSubscriptionSessionImportAdapter';
export { OAuthConnectCredentialStore } from './OAuthConnectAdapter';
export { OAuthIntegrationRegistry, requireTrustedOAuthIntegration, type AuthorizationCodeOAuthIntegration, type DeviceCodeOAuthIntegration, type DeviceCodeProtocolDescriptor, type OAuthConnectMode, type OAuthIntegration, } from './OAuthIntegrationRegistry';
export { OpenAiSubscriptionSessionImportAdapter, type LocalSessionImportAdapter, type LocalSessionImportResult, } from './OpenAiSubscriptionSessionImportAdapter';
export { LoopbackAuthorizationCallbackReceiver, type AuthorizationCodeCallbackReceiver, } from './LoopbackAuthorizationCallbackReceiver';
export type ConnectMode = 'browserAssistedApiKey' | OAuthConnectMode | 'connectUnsupported';
export type ConnectAttemptStatus = 'pending' | 'authorization_pending' | 'slow_down' | 'completed' | 'expired' | 'denied' | 'cancelled' | 'unsupported';
export interface ConnectBeginInput {
    webId: string;
    deployment: GatewayDeployment;
    provider: string;
    offeringId?: string;
    authorizationMethodId?: string;
    requestedMode: ConnectMode;
    expectedCredentialVersion?: number;
    auth?: AuthContext;
}
export interface ConnectBeginResult {
    mode: ConnectMode;
    status: ConnectAttemptStatus;
    provider: string;
    offeringId?: string;
    deployment: GatewayDeployment;
    attemptId?: string;
    state?: string;
    signature?: string;
    expiresAt?: string;
    authorizationUrl?: string;
    pkceChallenge?: string;
    deviceCode?: string;
    userCode?: string;
    verificationUri?: string;
    verificationUriComplete?: string;
    intervalSeconds?: number;
    apiKeyManagementSupported?: boolean;
    credentialId?: string;
    oauthCredential?: OneTimeOAuthCredential;
    message?: string;
}
export interface OneTimeOAuthCredential {
    accessToken: string;
    refreshToken: string;
    expiresAt?: string;
    scope?: string;
    idToken?: string;
    accountSubject?: string;
    accountLabel?: string;
    accountId?: string;
    offeringId?: string;
    authorizationMethodId?: string;
    expectedVersion?: number;
}
export interface CompleteApiKeyInput {
    webId: string;
    deployment: GatewayDeployment;
    provider: string;
    offeringId?: string;
    attemptId: string;
    state: string;
    signature: string;
    apiKey: string;
    accountLabel?: string;
    baseUrl?: string;
    auth?: AuthContext;
}
export interface PollDeviceInput {
    webId: string;
    deployment: GatewayDeployment;
    provider: string;
    offeringId?: string;
    mode?: OAuthConnectMode;
    attemptId: string;
    state: string;
    signature: string;
    auth?: AuthContext;
}
export interface RefreshInput {
    webId: string;
    deployment: GatewayDeployment;
    provider: string;
    offeringId?: string;
    mode?: OAuthConnectMode;
    credentialId?: string;
    auth?: AuthContext;
}
export interface CallerOwnedOAuthRefreshInput extends RefreshInput {
    credentialId: string;
    refreshToken: string;
    expectedVersion: number;
    authorizationMethodId?: string;
}
export interface DisconnectInput {
    webId: string;
    deployment: GatewayDeployment;
    provider: string;
    offeringId?: string;
    credentialId?: string;
    auth?: AuthContext;
}
export interface ConnectCredentialRecord {
    id: string;
    credentialIri: string;
    webId: string;
    provider: string;
    deployment: GatewayDeployment;
    authMode: 'apiKey' | 'deviceCodeOAuth' | 'local';
    encryptedSecret: EncryptedCredentialSecret;
    status: 'active' | 'revoked';
    accountLabel?: string;
    expiresAt?: Date;
    scopes?: string[];
    expectedVersion?: number;
    version?: number;
    reauthRequired?: boolean;
    offeringId?: string;
    proxyUrl?: string;
    priority?: number;
    enabled?: boolean;
    health?: 'healthy' | 'reauthRequired' | 'disabled' | 'error' | 'invalid' | 'unknown';
    selectedModels?: AiGatewayModelSummary[];
    metadata?: Record<string, unknown>;
}
export type CreateConnectCredentialRecord = Omit<ConnectCredentialRecord, 'id'> & {
    id?: string;
};
export interface ProviderCredentialQuery {
    webId: string;
    provider: string;
    deployment: GatewayDeployment;
    auth?: AuthContext;
}
export interface PodCredentialRepository {
    listProviderCredentials(input: ProviderCredentialQuery): Promise<ConnectCredentialRecord[]>;
    getCredentialById(input: ProviderCredentialQuery & {
        credentialId: string;
        keyVersion?: number;
    }): Promise<ConnectCredentialRecord | undefined>;
    createCredential(record: CreateConnectCredentialRecord, context?: {
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord>;
    updateCredential(input: ProviderCredentialQuery & {
        credentialId: string;
        keyVersion?: number;
        expectedVersion?: number;
        patch: Partial<ConnectCredentialRecord>;
    }): Promise<ConnectCredentialRecord | undefined>;
    revokeCredential(input: ProviderCredentialQuery & {
        credentialId: string;
        keyVersion?: number;
        expectedVersion?: number;
    }): Promise<ConnectCredentialRecord | undefined>;
    getCredential?(input: {
        webId: string;
        provider: string;
        deployment: GatewayDeployment;
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord | undefined>;
    getActiveCredential(input: {
        webId: string;
        provider: string;
        deployment: GatewayDeployment;
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord | undefined>;
    upsertConnectedCredential(record: ConnectCredentialRecord, context?: {
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord>;
    rewrapCredential?(input: {
        webId: string;
        deployment: GatewayDeployment;
        credentialId: string;
        keyVersion?: number;
        expectedVersion?: number;
        encryptedSecret: EncryptedCredentialSecret;
        auth?: AuthContext;
    }): Promise<boolean>;
    markReauthRequired(input: {
        webId: string;
        provider: string;
        deployment: GatewayDeployment;
        reason: string;
        expectedVersion?: number;
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord | undefined>;
    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
}
type ConnectedCredentialDb = {
    init?: (...resources: unknown[]) => Promise<void>;
    insert(resource: typeof credentialResource): {
        values(value: unknown): {
            execute(): Promise<unknown[]>;
        };
    };
    select(): {
        from(resource: typeof credentialResource | typeof aiProviderResource | typeof aiModelResource): {
            execute?(): Promise<Record<string, unknown>[]>;
            where(condition: unknown): {
                execute(): Promise<Record<string, unknown>[]>;
            };
        };
    };
    findById<TRow>(resource: typeof credentialResource | typeof aiProviderResource | typeof aiModelResource, id: string): Promise<TRow | null>;
    findByIri?<TRow>(resource: typeof credentialResource | typeof aiProviderResource | typeof aiModelResource, iri: string): Promise<TRow | null>;
    updateById<TRow>(resource: typeof credentialResource, id: string, patch: unknown): Promise<TRow | null>;
    update(resource: typeof credentialResource): {
        set(patch: unknown): {
            where(condition: unknown): {
                returning(): {
                    execute(): Promise<Record<string, unknown>[]>;
                };
            };
        };
    };
};
export interface PodConnectedCredentialRepositoryOptions {
    internalPodAccess?: InternalPodAccessTokenProvider;
    podBaseUrlResolver?: PodBaseUrlResolver;
    providerIds?: string[];
    dbFactory?: (input: {
        owner: string;
        auth?: AuthContext;
        fetch: typeof fetch;
        podUrl: string;
        credential?: typeof credentialResource;
        aiProvider?: typeof aiProviderResource;
        aiModel?: typeof aiModelResource;
    }) => Promise<ConnectedCredentialDb>;
}
export declare class PodConnectedCredentialRepository implements PodCredentialRepository {
    private readonly dbFactory;
    private readonly internalPodAccess?;
    private readonly podBaseUrlResolver?;
    private readonly providerIds;
    private readonly credentialTemplate;
    private readonly aiProviderTemplate;
    constructor(options?: PodConnectedCredentialRepositoryOptions);
    getCredential(input: {
        webId: string;
        provider: string;
        deployment: GatewayDeployment;
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord | undefined>;
    getActiveCredential(input: {
        webId: string;
        provider: string;
        deployment: GatewayDeployment;
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord | undefined>;
    listCredentials(input: {
        webId: string;
        deployment: GatewayDeployment;
        auth?: AuthContext;
    }): Promise<Array<{
        id: string;
        credentialIri: string;
        provider: string;
        authMode: 'apiKey' | 'deviceCodeOAuth' | 'local';
        enabled: boolean;
        accountLabel?: string;
        priority?: number;
        models?: string[];
        /** Display names the Pod recorded for `models`, keyed by model id. */
        modelNames?: Record<string, string>;
        customModels?: CustomProviderModel[];
        defaultModel?: string;
        health?: 'healthy' | 'reauthRequired' | 'disabled' | 'error' | 'invalid' | 'unknown';
        quota?: {
            status: 'available' | 'unsupported' | 'exhausted' | 'error';
        };
        encryptedSecret: EncryptedCredentialSecret;
        version?: number;
        runtimeCredential?: Record<string, unknown>;
        metadata?: Record<string, unknown>;
    }>>;
    listProviderCredentials(input: ProviderCredentialQuery): Promise<ConnectCredentialRecord[]>;
    getCredentialById(input: ProviderCredentialQuery & {
        credentialId: string;
        keyVersion?: number;
    }): Promise<ConnectCredentialRecord | undefined>;
    createCredential(record: CreateConnectCredentialRecord, context?: {
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord>;
    updateCredential(input: ProviderCredentialQuery & {
        credentialId: string;
        keyVersion?: number;
        expectedVersion?: number;
        patch: Partial<ConnectCredentialRecord>;
    }): Promise<ConnectCredentialRecord | undefined>;
    revokeCredential(input: ProviderCredentialQuery & {
        credentialId: string;
        keyVersion?: number;
        expectedVersion?: number;
    }): Promise<ConnectCredentialRecord | undefined>;
    private findCredentialRows;
    private dbForOwnerRows;
    private selectCredentialRows;
    upsertConnectedCredential(record: ConnectCredentialRecord, context?: {
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord>;
    rewrapCredential(input: {
        webId: string;
        deployment: GatewayDeployment;
        credentialId: string;
        expectedVersion?: number;
        encryptedSecret: EncryptedCredentialSecret;
        auth?: AuthContext;
    }): Promise<boolean>;
    markReauthRequired(input: {
        webId: string;
        provider: string;
        deployment: GatewayDeployment;
        reason: string;
        expectedVersion?: number;
        auth?: AuthContext;
    }): Promise<ConnectCredentialRecord | undefined>;
    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
    private withSelectedModels;
    private dbForOwner;
    private resolveTrustedFetch;
    private wrapPodFetch;
}
export interface ProviderConnectAdapter {
    readonly provider: string;
    readonly offeringId?: string;
    readonly mode?: ConnectMode;
    readonly authorizationMethodId?: string;
    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
    status?(input: PollDeviceInput): Promise<ConnectBeginResult>;
    completeApiKey?(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;
    pollDevice?(input: PollDeviceInput): Promise<ConnectBeginResult>;
    refresh?(input: RefreshInput, current: ConnectCredentialRecord, secret: ProviderSecret): Promise<ConnectCredentialRecord | undefined>;
    refreshCallerOwned?(input: CallerOwnedOAuthRefreshInput): Promise<ConnectBeginResult>;
    disconnect?(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
    cancel?(input: PollDeviceInput): Promise<ConnectBeginResult>;
}
interface ConnectAttempt {
    id: string;
    provider: string;
    deployment: GatewayDeployment;
    webId: string;
    mode: ConnectMode;
    offeringId?: string;
    authorizationMethodId?: string;
    state: string;
    signature: string;
    expiresAt: Date;
    consumedAt?: Date;
    expectedCredentialVersion?: number;
    codeVerifier?: string;
    deviceCode?: string;
    userCode?: string;
    intervalSeconds?: number;
    currentPollIntervalSeconds?: number;
    nextPollAt?: Date;
    pollClaimedAt?: Date;
    lastPollStatus?: ConnectAttemptStatus;
    terminalStatus?: Extract<ConnectAttemptStatus, 'denied' | 'cancelled' | 'expired'>;
}
interface PollClaimResult {
    attempt: ConnectAttempt;
    claimed: boolean;
}
export declare class InMemoryConnectAttemptStore {
    private readonly attempts;
    private readonly maxAttempts;
    create(attempt: ConnectAttempt): Promise<ConnectAttempt>;
    get(id: string, now?: Date): Promise<ConnectAttempt | undefined>;
    consume(id: string, now: Date, terminalStatus?: Extract<ConnectAttemptStatus, 'denied' | 'cancelled' | 'expired'>): Promise<ConnectAttempt>;
    claimPoll(id: string, now: Date): Promise<PollClaimResult>;
    updatePollSchedule(id: string, patch: {
        intervalSeconds: number;
        nextPollAt: Date;
        lastPollStatus: ConnectAttemptStatus;
    }): Promise<ConnectAttempt | undefined>;
    releasePollClaim(id: string): Promise<void>;
    private pruneExpired;
    private pruneBounded;
}
export interface SignedConnectAttemptAdapterOptions {
    provider: string;
    attempts: InMemoryConnectAttemptStore;
    credentialRepository: PodCredentialRepository;
    vault: CredentialVault;
    deployment: GatewayDeployment;
    now?: () => Date;
    randomBytes?: (bytes: number) => Buffer;
    signingSecret: string;
}
declare abstract class SignedConnectAttemptAdapterBase {
    readonly provider: string;
    protected readonly attempts: InMemoryConnectAttemptStore;
    protected readonly credentialRepository: PodCredentialRepository;
    protected readonly vault: CredentialVault;
    protected readonly deployment: GatewayDeployment;
    protected readonly now: () => Date;
    protected readonly randomBytes: (bytes: number) => Buffer;
    private readonly signingSecret;
    protected constructor(options: SignedConnectAttemptAdapterOptions);
    protected createAttempt(input: ConnectBeginInput, expiresAt: Date, extra?: Partial<ConnectAttempt>): Promise<ConnectAttempt>;
    protected loadAttemptForStatus(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt>;
    protected loadConsumableAttempt(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt>;
    protected statusForAttempt(attempt: ConnectAttempt): ConnectAttemptStatus;
    protected assertInput(input: ConnectBeginInput, mode: ConnectMode): void;
}
export interface BrowserAssistedApiKeyConnectAdapterOptions extends SignedConnectAttemptAdapterOptions {
    consoleUrl: string;
}
export declare class BrowserAssistedApiKeyConnectAdapter extends SignedConnectAttemptAdapterBase implements ProviderConnectAdapter {
    readonly mode: ConnectMode;
    private readonly consoleUrl;
    constructor(options: BrowserAssistedApiKeyConnectAdapterOptions);
    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
    completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;
    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
}
export interface DeviceCodeConnectAdapterOptions extends Omit<SignedConnectAttemptAdapterOptions, 'provider'> {
    fetch?: typeof fetch;
    integration: DeviceCodeOAuthIntegration;
    requestTimeoutMs?: number;
}
export declare class DeviceCodeConnectAdapter extends SignedConnectAttemptAdapterBase {
    readonly offeringId: string;
    readonly mode: ConnectMode;
    readonly authorizationMethodId = "device-code";
    private readonly fetchImpl;
    private readonly integration;
    private readonly clientId;
    private readonly protocol;
    private readonly oauthCredentials;
    private readonly requestTimeoutMs;
    constructor(options: DeviceCodeConnectAdapterOptions);
    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
    pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult>;
    private pendingPollStatus;
    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
    cancel(input: PollDeviceInput): Promise<ConnectBeginResult>;
    refresh(input: RefreshInput, current: ConnectCredentialRecord, secret: ProviderSecret): Promise<ConnectCredentialRecord | undefined>;
    refreshCallerOwned(input: CallerOwnedOAuthRefreshInput): Promise<ConnectBeginResult>;
    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
    private nowForConsume;
    private updateOAuthCredential;
    private findOAuthCredential;
    private resolveTokenBody;
    private providerRequest;
    private assertOfferingInput;
    private assertAuthorizationMethodInput;
    private assertAttemptOffering;
    private assertStoredOffering;
    private isProviderOAuthCredential;
}
export interface AuthorizationCodeConnectAdapterOptions extends Omit<SignedConnectAttemptAdapterOptions, 'provider'> {
    fetch?: typeof fetch;
    integration: AuthorizationCodeOAuthIntegration;
    callbackReceiver: AuthorizationCodeCallbackReceiver;
    requestTimeoutMs?: number;
}
export declare class AuthorizationCodeConnectAdapter extends SignedConnectAttemptAdapterBase {
    readonly offeringId: string;
    readonly mode: ConnectMode;
    readonly authorizationMethodId = "browser-oauth";
    private readonly fetchImpl;
    private readonly integration;
    private readonly clientId;
    private readonly callbackReceiver;
    private readonly oauthCredentials;
    private readonly requestTimeoutMs;
    private readonly callbacks;
    constructor(options: AuthorizationCodeConnectAdapterOptions);
    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
    pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult>;
    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
    cancel(input: PollDeviceInput): Promise<ConnectBeginResult>;
    refreshCallerOwned(input: CallerOwnedOAuthRefreshInput): Promise<ConnectBeginResult>;
    refresh(input: RefreshInput, current: ConnectCredentialRecord, secret: ProviderSecret): Promise<ConnectCredentialRecord | undefined>;
    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
    private authorizationUrl;
    private exchangeAuthorizationCode;
    private updateOAuthCredential;
    private findOAuthCredential;
    private providerRequest;
    private assertOfferingInput;
    private assertAuthorizationMethodInput;
    private assertAttemptOffering;
    private assertStoredOffering;
    private isProviderOAuthCredential;
    private loadAuthorizationAttempt;
    private closeCallback;
}
export declare class DeepSeekConnectAdapter implements ProviderConnectAdapter {
    readonly provider = "deepseek";
    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
}
export interface ProviderConnectServiceOptions {
    registry: ProviderRegistry;
    adapters: ProviderConnectAdapter[];
    localSessionImporters?: LocalSessionImportAdapter[];
    credentialRepository?: PodCredentialRepository;
    vault?: CredentialVault;
}
export interface ProviderConnectionSummary {
    provider: string;
    status: 'connected' | 'disconnected' | 'reauthRequired';
    authMode?: 'apiKey' | 'deviceCodeOAuth' | 'local';
    accountLabel?: string;
    baseUrl?: string;
    proxyUrl?: string;
    expiresAt?: string;
    reauthRequired?: boolean;
    credentialIri?: string;
    version?: number;
    connect: {
        modes: string[];
        configured: boolean;
        message?: string;
    };
}
export interface AiProviderCredentialSummary {
    id: string;
    provider: string;
    offeringId: string;
    authMode: 'oauth' | 'deviceCode' | 'apiKey' | 'local';
    label?: string;
    enabled: boolean;
    priority: number;
    health: 'healthy' | 'expired' | 'invalid' | 'unknown';
    maskedHint?: string;
    baseUrl?: string;
    proxyUrl?: string;
    expiresAt?: string;
    version: number;
    quota?: unknown;
}
export interface AiGatewayModelSummary {
    id: string;
    provider: string;
    offeringId?: string;
    resourceId?: string;
    displayName?: string;
    custom?: boolean;
    inputModalities?: string[];
    outputModalities?: string[];
    /** Custom models declare their own tokens; catalog models carry the object flags. */
    capabilities?: string[] | ProviderCapabilities;
    /** Token list the client reads first, so custom declarations survive normalisation. */
    custom_capabilities?: string[];
    modalities?: {
        input?: string[];
        output?: string[];
    };
}
export interface AiProviderPoolSummary {
    id: string;
    name: string;
    status: 'unconfigured' | 'configured' | 'available' | 'attention' | 'unavailable';
    offerings: Array<{
        id: string;
        label: string;
        kind?: string;
        lifecycle: 'active' | 'legacy' | 'unavailable';
        authModes?: string[];
        authorizationMethods?: OfferingAuthorizationMethod[];
        runtimeProviderIds?: string[];
        productLabel: string;
        credentialPrefixHints: string[];
        consoleUrl: string;
        subscriptionUrl: string;
        endpoints: Array<{
            protocol: string;
            baseUrl: string;
            region?: string;
        }>;
        modelDiscovery: {
            strategy: string;
            path: string;
            endpointProtocol: string;
        };
        quota: {
            strategy: string;
            url: string;
        };
        usagePolicyUrl: string;
        region: string;
    }>;
    credentials: AiProviderCredentialSummary[];
    selectedModels: AiGatewayModelSummary[];
}
export interface ProviderOfferingAuthorizationMethodsSummary {
    provider: string;
    offeringId: string;
    authorizationMethods: OfferingAuthorizationMethod[];
    endpoints?: ProviderOfferingEndpointDescriptor[];
}
export interface ProviderCredentialTestModelsService {
    list(input: {
        webId: string;
        deployment: GatewayDeployment;
        provider: string;
        credentialIri?: string;
    }): Promise<{
        models: Array<{
            id: string;
            displayName?: string;
            capabilities?: string[];
        }>;
        observedAt: string;
    }>;
}
export declare class ProviderConnectService {
    /** Cloud settings only manage providers this deployment provides. */
    private requireProvidedProvider;
    /**
     * Cloud owns the endpoint: a caller may not point a provided provider at its
     * own base URL or proxy. Supplying the provided endpoint verbatim (what the
     * applet does when it fills the offering default) stays valid.
     */
    private assertEndpointIsProvided;
    private providedEndpoints;
    private static readonly localImportLocks;
    private readonly registry;
    private readonly credentialRepository?;
    private readonly vault?;
    private readonly adapters;
    private readonly localSessionImporters;
    constructor(options: ProviderConnectServiceOptions);
    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
    getAuthorizationMethods(): ProviderOfferingAuthorizationMethodsSummary[];
    listProviders(input: {
        webId: string;
        deployment: GatewayDeployment;
        auth?: AuthContext;
    }): Promise<ProviderConnectionSummary[]>;
    listProviderCredentialPools(input: {
        webId: string;
        deployment: GatewayDeployment;
        auth?: AuthContext;
    }): Promise<AiProviderPoolSummary[]>;
    createApiKeyCredential(input: {
        webId: string;
        deployment: GatewayDeployment;
        provider: string;
        offeringId?: string;
        apiKey: string;
        label?: string;
        baseUrl?: string;
        proxyUrl?: string;
        priority?: number;
        auth?: AuthContext;
    }): Promise<AiProviderCredentialSummary>;
    createLocalCredential(input: {
        webId: string;
        deployment: GatewayDeployment;
        provider: string;
        offeringId?: string;
        label?: string;
        baseUrl?: string;
        priority?: number;
        auth?: AuthContext;
    }): Promise<AiProviderCredentialSummary>;
    private importLocalCredential;
    private refreshImportedSecret;
    updateCredential(input: ProviderCredentialQuery & {
        credentialId: string;
        expectedVersion: number;
        patch: {
            label?: string;
            enabled?: boolean;
            priority?: number;
            baseUrl?: string;
            proxyUrl?: string;
        };
    }): Promise<AiProviderCredentialSummary | undefined>;
    revokeCredential(input: ProviderCredentialQuery & {
        credentialId: string;
    }): Promise<AiProviderCredentialSummary | undefined>;
    testCredential(input: ProviderCredentialQuery & {
        credentialId?: string;
        apiKey?: string;
        modelsService?: ProviderCredentialTestModelsService;
    }): Promise<{
        status: 'ok';
        checkedAt: string;
        models: Array<{
            id: string;
            displayName?: string;
            capabilities?: string[];
        }>;
    }>;
    private markCredentialHealth;
    private requireLocalOffering;
    completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;
    pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult>;
    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
    refresh(input: RefreshInput): Promise<ConnectCredentialRecord | undefined>;
    refreshCallerOwned(input: CallerOwnedOAuthRefreshInput): Promise<ConnectBeginResult>;
    private refreshWithRetry;
    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
    cancel(input: PollDeviceInput): Promise<ConnectBeginResult>;
    private runAttemptOperation;
    private requireOAuthRefreshAdapter;
    private getRefreshCredential;
    private requireAdapter;
    private requireAdapterForAttemptStatus;
    private requireAdapterForDisconnect;
    private findAdapter;
    private findAdapterCandidates;
    private requireConnectOffering;
    private offeringSupportsConnectMode;
    private authorizationMethodUnavailableReason;
}
export interface CustomProviderModel {
    id: string;
    displayName?: string;
    inputModalities?: string[];
    outputModalities?: string[];
    capabilities?: string[];
}
export declare function customModelsFromMetadata(metadata: Record<string, unknown> | undefined): CustomProviderModel[];