import { O as OAuthConfig } from './index-bq7b_mHy.js';
import 'zod';
import './db.js';
import 'kysely';
import './index-eydqYIn0.js';
import 'pg';
import 'postgres';
import './orm.js';
import './types-Bsv_KdHs.js';

type OAuthState = {
    plugin: string;
    tenantId: string;
    iat: number;
};
declare function encodeOAuthState(plugin: string, tenantId: string): string;
declare function decodeOAuthState(state: string, { maxAgeMs }?: {
    maxAgeMs?: number;
}): OAuthState | null;

type BuildOAuthAuthorizeUrlInput = {
    oauthConfig: OAuthConfig;
    clientId: string;
    redirectUri: string;
    state: string;
};
declare function buildOAuthAuthorizeUrl(input: BuildOAuthAuthorizeUrlInput): string;

type OAuthCallbackErrorCode = 'invalid_corsair_instance' | 'no_database' | 'invalid_state' | 'plugin_not_found' | 'plugin_has_no_oauth_config' | 'credentials_not_configured' | 'no_access_token';
declare class OAuthCallbackError extends Error {
    readonly code: OAuthCallbackErrorCode;
    constructor(code: OAuthCallbackErrorCode, message: string);
}
type GenerateOAuthUrlOptions = {
    tenantId: string;
    redirectUri: string;
    /** Hub generates OAuth state server-side and injects it into the authorize URL. */
    hubConnect?: boolean;
};
type GenerateOAuthUrlResult = {
    url: string;
    state: string;
};
/**
 * Builds an OAuth authorization URL for the given plugin and tenant.
 *
 * Embed the returned `url` in a button or link for the customer to click.
 * The returned `state` is HMAC-signed — pass it to processOAuthCallback as-is.
 *
 * Requires the plugin to have an oauthConfig (e.g. googlecalendar, gmail,
 * notion, spotify). Plugins like slack and linear use API keys, not OAuth.
 * The plugin's client_id and client_secret must be set via `corsair setup`.
 *
 * Works for both multi-tenant and single-tenant corsair instances.
 */
declare function generateOAuthUrl(corsair: unknown, pluginId: string, options: GenerateOAuthUrlOptions): Promise<GenerateOAuthUrlResult>;
type ProcessOAuthCallbackOptions = {
    code: string;
    state: string;
    /** Must exactly match the redirectUri passed to generateOAuthUrl. */
    redirectUri: string;
    /**
     * Set ONLY by a caller that has already verified the request signature (a
     * Hub-signed delivery envelope). When true, `state` is not HMAC-verified and
     * `plugin`/`tenantId` are read from here instead — Hub cannot sign a Corsair
     * state because it never holds the project KEK. Never set this from a wire
     * field; the whole security of the bypass rests on it being caller-asserted.
     */
    trusted?: boolean;
    /** Required when `trusted` is true. Ignored otherwise (state is decoded). */
    plugin?: string;
    tenantId?: string;
};
type ProcessOAuthCallbackResult = {
    plugin: string;
    tenantId: string;
};
/**
 * Completes the OAuth flow by exchanging the authorization code for tokens
 * and storing them encrypted in the database for the tenant.
 *
 * Call this inside your /api/auth route after receiving `code` and `state`
 * from the provider redirect.
 *
 * @throws if state is invalid, credentials are missing, or token exchange fails
 */
declare function processOAuthCallback(corsair: unknown, options: ProcessOAuthCallbackOptions): Promise<ProcessOAuthCallbackResult>;

/** One renewal pass over every connected account of every subscribable plugin. */
declare function renewSubscriptions(corsair: unknown): Promise<{
    renewed: string[];
    failed: string[];
}>;
/**
 * Start periodic BYO subscription renewal. Call once at app startup (a
 * long-running server; serverless apps should invoke renewSubscriptions from
 * their own scheduler instead). Runs immediately, then on the interval.
 * Default 45 min sits inside MS Graph's 60-minute expiry — the tightest
 * provider window. Returns a stop function.
 *
 * In-process interval: with multiple app instances each renews independently;
 * re-subscribes are idempotent so that only adds provider API chatter. Move
 * to a shared scheduler (e.g. a db-backed job) when running many instances.
 */
declare function startSubscriptionRenewal(corsair: unknown, options?: {
    intervalMinutes?: number;
}): () => void;

export { type BuildOAuthAuthorizeUrlInput, type GenerateOAuthUrlOptions, type GenerateOAuthUrlResult, OAuthCallbackError, type OAuthCallbackErrorCode, type ProcessOAuthCallbackOptions, type ProcessOAuthCallbackResult, buildOAuthAuthorizeUrl, decodeOAuthState, encodeOAuthState, generateOAuthUrl, processOAuthCallback, renewSubscriptions, startSubscriptionRenewal };