import Conf from 'conf';
import { ClientCredentialsObject } from '@zapier/zapier-sdk';
export { ZapierAuthenticationError } from '@zapier/zapier-sdk';
import { z } from 'zod';

declare const DEFAULT_AUTH_BASE_URL = "https://zapier.com";
declare function getConfig(): Conf;

/**
 * Default filesystem + OS keychain cache adapter for the SDK.
 *
 * Conforms to the generic ZapierCache interface that the SDK defines.
 * Secrets go to the OS keychain via cross-keychain; non-secret values
 * and the identity metadata (expires_at, secret flag) go to the
 * existing zapier-sdk-cli Conf file. A proper-lockfile lock wraps the
 * exchange/persist critical section so N concurrent CLI invocations
 * collapse to a single network exchange.
 *
 * The SDK treats this (like any ZapierCache) as a cache — values may
 * disappear, and the caller must always be able to recreate them.
 */
declare function createCache(): {
    get(key: string): Promise<{
        value: string;
        expiresAt?: number;
    } | undefined>;
    set(key: string, value: string, options?: {
        secret?: boolean;
        ttl?: number;
    }): Promise<void>;
    delete(key: string): Promise<void>;
    withLock<T>(key: string, fn: () => Promise<T>): Promise<T>;
};

declare const CredentialsEntrySchema: z.ZodObject<{
    name: z.ZodString;
    clientId: z.ZodString;
    createdAt: z.ZodNumber;
    scopes: z.ZodArray<z.ZodString>;
    baseUrl: z.ZodString;
}, z.core.$strip>;
type CredentialsEntry = z.infer<typeof CredentialsEntrySchema>;
declare function getActiveCredentials(options?: {
    baseUrl?: string;
}): CredentialsEntry | undefined;
declare function getStoredClientCredentials(options?: {
    name?: string;
    baseUrl?: string;
}): Promise<ClientCredentialsObject | undefined>;

type DebugLog = (message: string, data?: unknown) => void;
declare function clearTokensFromKeychain({ debugLog, }?: {
    debugLog?: DebugLog;
}): Promise<void>;

/**
 * Zapier SDK CLI Login Package
 *
 * Handles login, logout, token cache and refresh for Zapier SDK CLI.
 * Provides getToken function that can be optionally imported by zapier-sdk.
 */

interface PkceCredentials {
    type: "pkce";
    clientId: string;
    baseUrl?: string;
    scope?: string;
}
interface AuthOptions {
    onEvent?: (event: {
        type: string;
        payload: Record<string, unknown>;
        timestamp: number;
    }) => void;
    fetch?: typeof globalThis.fetch;
    /** Credentials object from SDK. Contains clientId and resolved auth baseUrl. */
    credentials?: PkceCredentials;
    /** Enable debug logging for fetch requests and config operations. */
    debug?: boolean;
}
interface LoginData {
    access_token: string;
    refresh_token: string;
    expires_in: number;
}
declare const AUTH_MODE_HEADER = "X-Auth";
/**
 * Gets the OAuth token endpoint URL.
 * baseUrl should be the auth base URL (e.g., https://zapier.com), already resolved by SDK.
 */
declare function getAuthTokenUrl(options?: {
    baseUrl?: string;
}): string;
/**
 * Gets the OAuth authorization endpoint URL.
 * baseUrl should be the auth base URL (e.g., https://zapier.com), already resolved by SDK.
 */
declare function getAuthAuthorizeUrl(options?: {
    baseUrl?: string;
}): string;
/**
 * Configuration needed for PKCE login flow.
 */
interface PkceLoginConfig {
    clientId: string;
    tokenUrl: string;
    authorizeUrl: string;
}
/**
 * Gets all configuration needed for the PKCE login flow.
 * Credentials should have baseUrl already resolved by SDK.
 * baseUrl is a fallback used when credentials carry no baseUrl of their own.
 */
declare function getPkceLoginConfig(options?: {
    credentials?: PkceCredentials;
    baseUrl?: string;
}): PkceLoginConfig;
type LoginStorageMode = "keychain" | "config";
/**
 * Drops the cached Conf instance so the next getConfig() call re-initializes
 * from disk (including re-running the pre-existing file detection).
 */
declare function unloadConfig(): void;
declare function updateLogin(loginData: LoginData, options?: {
    storage?: LoginStorageMode;
    debug?: boolean;
}): Promise<void>;
/**
 * Main function exported for zapier-sdk to optionally use.
 * Returns the stored token from CLI configuration (with auto-refresh).
 *
 * Note: Environment variable handling (ZAPIER_CREDENTIALS, ZAPIER_TOKEN)
 * is done by the SDK before calling this function.
 *
 * Returns undefined if no valid token is found.
 */
declare function getToken(options?: AuthOptions): Promise<string | undefined>;
/**
 * Gets the logged-in user information from JWT token.
 * Automatically refreshes token if expired.
 */
declare function getLoggedInUser(options?: AuthOptions): Promise<{
    accountId: number;
    customUserId: number;
    email: string;
}>;
/**
 * Checks config to determine current cache mode without reading keychain.
 * Credential keys in config are ground truth — if login_jwt exists, we're in
 * config mode regardless of the marker. The marker only matters when no
 * credential keys are present (e.g. after logout or when using keychain).
 */
declare function getLoginStorageMode(): LoginStorageMode;
/**
 * Clears stored login information.
 */
declare function logout(options?: Pick<AuthOptions, "onEvent">): Promise<void>;
/**
 * Gets the path to the configuration file.
 */
declare function getConfigPath(): string;

export { AUTH_MODE_HEADER, type AuthOptions, DEFAULT_AUTH_BASE_URL, type LoginData, type LoginStorageMode, type PkceCredentials, type PkceLoginConfig, clearTokensFromKeychain, createCache, getActiveCredentials, getAuthAuthorizeUrl, getAuthTokenUrl, getConfig, getConfigPath, getLoggedInUser, getLoginStorageMode, getPkceLoginConfig, getStoredClientCredentials, getToken, logout, unloadConfig, updateLogin };