import { BoxClient } from "box-typescript-sdk-gen";
import type { Adapter } from "../index.js";
import { FilesError } from "../internal/errors.js";
/**
 * The OAuth token pair Box's SDK keeps in a {@link BoxTokenStorage}. Persist
 * it whole (it may carry more fields than these) and hand the same object
 * back from `get()`.
 */
export interface BoxOAuthToken {
    readonly accessToken?: string;
    readonly refreshToken?: string;
    /** Access-token lifetime in seconds, as Box reported it. */
    readonly expiresIn?: number;
    readonly tokenType?: string;
}
/**
 * Where the OAuth tokens live between refreshes — the Box SDK's own
 * `TokenStorage` contract. Box refresh tokens are single-use: every refresh
 * returns a new one and invalidates the old. Back this with a database or KV
 * store so the rotated token survives a restart and is shared by every
 * instance using the same Box authorization.
 */
export interface BoxTokenStorage {
    get: () => Promise<BoxOAuthToken | undefined>;
    store: (token: BoxOAuthToken) => Promise<void>;
    clear: () => Promise<void>;
}
export interface BoxOAuthOptions {
    readonly clientId: string;
    readonly clientSecret: string;
    /**
     * A refresh token previously obtained via Box's authorization code flow.
     * The adapter seeds the token storage with this value; the SDK then
     * exchanges it for an access token on the first API call and re-refreshes
     * when the access token expires.
     *
     * Box refresh tokens are **single-use**: each refresh rotates it, and the
     * one you passed stops working. Without `tokenStorage` the rotated token
     * lives only in this instance's memory, so after a restart (or in a second
     * instance) this value is spent and every call fails `Unauthorized`. When
     * `tokenStorage` already holds a token, that one is used and this value is
     * only the first-run seed.
     */
    readonly refreshToken: string;
    /**
     * Persistent storage for the OAuth tokens, so the rotated refresh token
     * outlives the process. Defaults to in-memory storage. For server
     * workloads, prefer `ccg` or `jwt`, which need no stored user token.
     */
    readonly tokenStorage?: BoxTokenStorage;
}
export interface BoxCcgOptions {
    readonly clientId: string;
    readonly clientSecret: string;
    /**
     * Pass `enterpriseId` to authenticate as the service account, or `userId`
     * to authenticate as a managed/app user. At least one is required.
     */
    readonly enterpriseId?: string;
    readonly userId?: string;
}
export type BoxJwtOptions = {
    readonly configJsonString: string;
} | {
    readonly configFilePath: string;
};
export interface BoxAdapterOptions {
    /**
     * Logical "bucket root" — virtual keys live under this Box folder ID.
     * Use `"0"` (the default) to anchor at the user's root folder. The folder
     * must already exist; intermediate subfolders are auto-created on upload.
     */
    rootFolderId?: string;
    /**
     * When `true`, `upload()` also creates a public shared link (anyone with
     * the link can preview/download) and `url()` returns that link's
     * `download_url` (or `url` if `download_url` is absent — typical for
     * non-binary previews). When `false` (default), `url()` mints a
     * short-lived signed download URL via `getDownloadFileUrl` — as does
     * `url(key, { expiresIn })` in either mode.
     *
     * **Plan/policy note:** public shared links may be restricted on Box
     * Business or Enterprise plans; the adapter surfaces Box's
     * `access_denied_insufficient_permissions` error unmodified in that case.
     */
    publicByDefault?: boolean;
    /**
     * Origin used to build URLs from `url()`. When set, `url(key)` returns
     * `${publicBaseUrl}/${key}` and skips both signing and shared-link
     * resolution. Useful when a CDN or vanity domain sits in front of
     * pre-shared Box links. `url(key, { expiresIn })` still mints a signed
     * download URL.
     */
    publicBaseUrl?: string;
    /**
     * Default expiry, in seconds, for the signed download URLs `url()` mints
     * via `getDownloadFileUrl`. Accepted for API symmetry but not honoured:
     * `getDownloadFileUrl` takes no expiry, so Box controls the TTL
     * server-side (the URLs are short-lived by API design). Defaults to 3600.
     */
    defaultUrlExpiresIn?: number;
    /**
     * Pre-built `BoxClient` — escape hatch for callers that already wire
     * auth themselves (e.g. with custom `NetworkSession`, proxy config, or
     * downscoped tokens).
     */
    client?: BoxClient;
    /**
     * Static developer token from the Box developer console. Useful for
     * scripts and trying the adapter; production apps should use OAuth, CCG,
     * or JWT instead. Falls back to env `BOX_DEVELOPER_TOKEN`.
     */
    developerToken?: string;
    /** OAuth2 user-app flow seeded with a refresh token. */
    oauth?: BoxOAuthOptions;
    /** Server-side Client Credentials Grant. */
    ccg?: BoxCcgOptions;
    /** JWT Server Authentication, configured via the JSON blob from Box's developer console. */
    jwt?: BoxJwtOptions;
}
export type { BoxClient } from "box-typescript-sdk-gen";
export type BoxAdapter = Adapter<BoxClient> & {
    readonly rootFolderId: string;
};
export declare const mapBoxError: (cause: unknown) => FilesError;
export declare const box: (opts?: BoxAdapterOptions) => BoxAdapter;
//# sourceMappingURL=index.d.ts.map