import { OAuthClientMetadata, OAuthTokens } from './oauth';
/**
 * Configuration options for the Prometheus Browser Client.
 */
export interface PrometheusClientOptions {
    /** The canister Principal ID of the main Prometheus auth canister. */
    authCanisterId: string;
    /** The full base URL of the target resource server API (e.g., "https://api.myapp.com"). */
    resourceServerUrl: string;
    /** The host URL for the Internet Computer (e.g., "https://icp-api.io" for production). */
    icHost: string;
    /**
     * Metadata for this client application, used for Dynamic Client Registration.
     * The `redirect_uris` will be automatically set to the current window's origin.
     */
    clientMetadata: Omit<OAuthClientMetadata, 'redirect_uris'>;
}
/**
 * Represents an authenticated client instance returned after a successful login flow.
 * It holds the user's tokens and provides convenience methods for accessing them.
 */
export interface PrometheusClient {
    /** The raw OAuth tokens (`access_token`, `refresh_token`, etc.). */
    tokens: OAuthTokens;
    /** A method to get the user's Principal ID (the `sub` claim) from the access token. */
    getPrincipal: () => string;
    /** A method to get the raw access token string, suitable for use in an `Authorization: Bearer` header. */
    getAccessToken: () => string;
}
/**
 * Handles the entire browser-based OAuth2 flow, including Dynamic Client
 * Registration, token exchange, and token refresh. This is the recommended entry
 * point for browser applications.
 *
 * **IMPORTANT:** This function is designed to be called on every page load.
 * On the first run for a new user, it will trigger a full-page redirect to the
 * Prometheus login page. In this scenario, the returned promise will **never resolve**,
 * as the page context is navigated away.
 *
 * After the user authenticates and is redirected back to your application, this
 * function should be called again. It will automatically handle the authorization
 * code exchange, clear the code from the URL, and resolve with an authenticated
 * `PrometheusClient` instance.
 *
 * @param options The configuration options for the client.
 * @returns A promise that resolves with an authenticated `PrometheusClient` instance.
 *          This promise does not resolve if a redirect is initiated.
 * @throws `Error` if the authorization flow completes successfully but no tokens are
 *         found in storage, indicating an internal state inconsistency.
 */
export declare function createPrometheusClient(options: PrometheusClientOptions): Promise<PrometheusClient>;
