import { AgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
import * as pg0 from "pg";
import { z } from "zod";
import { BetterAuthAdvancedOptions } from "better-auth";
import { GoogleOptions, MicrosoftOptions } from "better-auth/social-providers";

//#region src/auth/auth-types.d.ts
type AuthMethodType = 'email-password' | 'google' | 'microsoft' | 'sso';
declare const authMethodTypeSchema: z.ZodEnum<{
  "email-password": "email-password";
  google: "google";
  microsoft: "microsoft";
  sso: "sso";
}>;
declare const methodOptionSchema: z.ZodObject<{
  method: z.ZodEnum<{
    "email-password": "email-password";
    google: "google";
    microsoft: "microsoft";
    sso: "sso";
  }>;
  providerId: z.ZodOptional<z.ZodString>;
  providerType: z.ZodOptional<z.ZodEnum<{
    oidc: "oidc";
    saml: "saml";
  }>>;
  displayName: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
type MethodOption = z.infer<typeof methodOptionSchema>;
declare const orgAuthInfoSchema: z.ZodObject<{
  organizationId: z.ZodString;
  organizationName: z.ZodString;
  organizationSlug: z.ZodOptional<z.ZodString>;
  methods: z.ZodArray<z.ZodObject<{
    method: z.ZodEnum<{
      "email-password": "email-password";
      google: "google";
      microsoft: "microsoft";
      sso: "sso";
    }>;
    providerId: z.ZodOptional<z.ZodString>;
    providerType: z.ZodOptional<z.ZodEnum<{
      oidc: "oidc";
      saml: "saml";
    }>>;
    displayName: z.ZodOptional<z.ZodString>;
  }, z.core.$strip>>;
}, z.core.$strip>;
type OrgAuthInfo = z.infer<typeof orgAuthInfoSchema>;
declare const authLookupResponseSchema: z.ZodObject<{
  organizations: z.ZodArray<z.ZodObject<{
    organizationId: z.ZodString;
    organizationName: z.ZodString;
    organizationSlug: z.ZodOptional<z.ZodString>;
    methods: z.ZodArray<z.ZodObject<{
      method: z.ZodEnum<{
        "email-password": "email-password";
        google: "google";
        microsoft: "microsoft";
        sso: "sso";
      }>;
      providerId: z.ZodOptional<z.ZodString>;
      providerType: z.ZodOptional<z.ZodEnum<{
        oidc: "oidc";
        saml: "saml";
      }>>;
      displayName: z.ZodOptional<z.ZodString>;
    }, z.core.$strip>>;
  }, z.core.$strip>>;
}, z.core.$strip>;
type AuthLookupResponse = z.infer<typeof authLookupResponseSchema>;
interface OIDCProviderConfig {
  clientId: string;
  clientSecret: string;
  authorizationEndpoint?: string;
  tokenEndpoint?: string;
  userinfoEndpoint?: string;
  jwksEndpoint?: string;
  discoveryEndpoint?: string;
  scopes?: string[];
  pkce?: boolean;
  mapping?: {
    id?: string;
    email?: string;
    emailVerified?: string;
    name?: string;
    image?: string;
    extraFields?: Record<string, string>;
  };
}
interface SAMLProviderConfig {
  entryPoint: string;
  cert: string;
  callbackUrl: string;
  audience?: string;
  wantAssertionsSigned?: boolean;
  signatureAlgorithm?: string;
  digestAlgorithm?: string;
  identifierFormat?: string;
  mapping?: {
    id?: string;
    email?: string;
    name?: string;
    firstName?: string;
    lastName?: string;
    emailVerified?: string;
    extraFields?: Record<string, string>;
  };
}
interface SSOProviderConfig {
  providerId: string;
  issuer: string;
  domain: string;
  organizationId?: string;
  oidcConfig?: OIDCProviderConfig;
  samlConfig?: SAMLProviderConfig;
}
declare const allowedAuthMethodSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
  method: z.ZodLiteral<"email-password">;
}, z.core.$strip>, z.ZodObject<{
  method: z.ZodLiteral<"google">;
}, z.core.$strip>, z.ZodObject<{
  method: z.ZodLiteral<"microsoft">;
}, z.core.$strip>, z.ZodObject<{
  method: z.ZodLiteral<"sso">;
  providerId: z.ZodString;
  displayName: z.ZodString;
  autoProvision: z.ZodBoolean;
  enabled: z.ZodBoolean;
}, z.core.$strip>], "method">;
type AllowedAuthMethod = z.infer<typeof allowedAuthMethodSchema>;
declare function parseAllowedAuthMethods(raw: string | null | undefined): AllowedAuthMethod[];
declare function serializeAllowedAuthMethods(methods: AllowedAuthMethod[]): string;
interface EmailServiceConfig {
  sendInvitationEmail(data: {
    to: string;
    inviterName: string;
    organizationName: string;
    role: string;
    invitationUrl: string;
    authMethod?: string;
    expiresInDays?: number;
  }): Promise<{
    emailSent: boolean;
    error?: string;
  }>;
  sendPasswordResetEmail(data: {
    to: string;
    resetUrl: string;
    expiresInMinutes?: number;
  }): Promise<{
    emailSent: boolean;
    error?: string;
  }>;
  isConfigured: boolean;
}
interface RecaptchaConfig {
  secretKey: string;
  minScore?: number;
}
interface BetterAuthConfig {
  baseURL: string;
  secret: string;
  dbClient: AgentsRunDatabaseClient;
  manageDbPool?: pg0.Pool;
  cookieDomain?: string;
  socialProviders?: {
    google?: GoogleOptions;
    microsoft?: MicrosoftOptions;
  };
  advanced?: BetterAuthAdvancedOptions;
  emailService?: EmailServiceConfig;
  recaptcha?: RecaptchaConfig;
}
interface UserAuthConfig {
  socialProviders?: {
    google?: GoogleOptions;
    microsoft?: MicrosoftOptions;
  };
  advanced?: BetterAuthAdvancedOptions;
}
//#endregion
export { AllowedAuthMethod, AuthLookupResponse, AuthMethodType, BetterAuthConfig, EmailServiceConfig, MethodOption, OIDCProviderConfig, OrgAuthInfo, RecaptchaConfig, SAMLProviderConfig, SSOProviderConfig, UserAuthConfig, authLookupResponseSchema, authMethodTypeSchema, methodOptionSchema, orgAuthInfoSchema, parseAllowedAuthMethods, serializeAllowedAuthMethods };