import { AgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";

//#region src/auth/sso-issuer-discovery.d.ts
type OidcEndpointPatch = {
  discoveryEndpoint: string;
  authorizationEndpoint: string;
  tokenEndpoint: string;
  jwksEndpoint: string;
  userInfoEndpoint?: string;
  tokenEndpointAuthentication?: 'client_secret_basic' | 'client_secret_post';
};
type RediscoveryContext = {
  path: string;
  body: unknown;
  context: {
    isTrustedOrigin: (url: string) => boolean;
  };
};
/**
 * Re-runs OIDC discovery server-side when an SSO provider's issuer is being
 * changed via `/sso/update-provider`, returning a Better Auth context patch
 * that overwrites the request body's `oidcConfig` with endpoints freshly
 * derived from the new issuer.
 *
 * Why this exists (do not remove without replacing the behavior):
 * `@better-auth/sso`'s update path merges every cached endpoint with
 * `updates.X ?? current.X` and never recomputes them from a changed issuer
 * (the register path does), so the stored discovery/authorization/token/jwks/
 * userinfo endpoints keep pointing at the old IdP and sign-in keeps hitting it.
 * The client cannot fix this: the update schema validates each endpoint as
 * `z.string().url()` (so empty strings to clear stale values are rejected) and
 * a browser fetch of the new issuer's discovery document is subject to CORS.
 * Running discovery here — server-side, at the single update chokepoint —
 * sidesteps both and corrects the stored config eagerly.
 *
 * Returns `undefined` (no-op) for any non-update path, a missing
 * provider/issuer, an unchanged issuer, or a provider that can't be read.
 *
 * @throws APIError(BAD_REQUEST) when discovery against the new issuer fails,
 * mirroring the register path's refusal to persist an unreachable issuer.
 */
declare function maybeRediscoverSsoIssuer(ctx: RediscoveryContext, dbClient: AgentsRunDatabaseClient): Promise<{
  context: {
    body: {
      oidcConfig: OidcEndpointPatch;
    };
  };
} | undefined>;
//#endregion
export { maybeRediscoverSsoIssuer };