/**
 * OAuthClient — OAuth flows for **daemon authentication**.
 *
 * Wraps the pure PKCE/OAuth 2.0 functions in `oauth-core.ts` behind a class
 * boundary so callers can inject config once and call methods, rather than
 * threading `OAuthProviderConfig` through every call.
 *
 * This client handles authentication between the SDK and the goodvibes daemon.
 * For OAuth flows that subscribe to external AI providers (OpenAI, Anthropic,
 * etc.), see {@link SubscriptionManager} in
 * `../config/subscriptions.ts`.
 *
 * @see SubscriptionManager — OAuth flows for provider subscriptions.
 */
import { buildOAuthAuthorizationStart, decodeJwtPayload, exchangeOAuthAuthorizationCode, refreshOAuthAccessToken, } from './oauth-core.js';
export class OAuthClient {
    #config;
    constructor(config) {
        this.#config = config;
    }
    /**
     * Build the authorization URL and PKCE state needed to start an OAuth flow.
     * Redirect the user's browser to `result.authorizationUrl`.
     */
    async beginAuthorization(input) {
        return buildOAuthAuthorizationStart(this.#config, input);
    }
    /**
     * Exchange an authorization code (returned via the redirect) for tokens.
     * Use the `state` and `verifier` from the matching `beginAuthorization` call.
     */
    async exchangeCode(input) {
        return exchangeOAuthAuthorizationCode(this.#config, input);
    }
    /**
     * Use a refresh token to obtain a new access token without user interaction.
     */
    async refreshToken(refreshToken) {
        return refreshOAuthAccessToken(this.#config, refreshToken);
    }
    /**
     * Decode a JWT access token's payload without verification.
     * Returns null when the token is malformed.
     */
    decodeJwtPayload(token) {
        return decodeJwtPayload(token);
    }
    /** Expose the provider config this client was built from. */
    get config() {
        return this.#config;
    }
}
