import { D as DeviceFlowResult, C as CopilotAuthToken, O as OAuthFlowOptions, a as OAuthFlowResult, b as ClaudeAuthToken } from '../types-BxggH0Yh.js';
export { c as AccessDeniedError, d as AuthError, A as AuthToken, e as DeviceCodeExpiredError, T as TokenExchangeError } from '../types-BxggH0Yh.js';
export { T as TokenRefreshEvents, a as TokenRefreshManager, b as TokenRefreshOptions } from '../refresh-manager-Dlv_iNZi.js';
import '../errors-CmVvczxZ.js';

/** Fetch function type for dependency injection in tests */
type FetchFn$1 = typeof globalThis.fetch;
/**
 * Programmatic GitHub Device Flow authentication for Copilot SDK.
 *
 * @example
 * ```ts
 * const auth = new CopilotAuth();
 * const flow = await auth.startDeviceFlow();
 * console.log(`Open ${flow.verificationUrl} and enter ${flow.userCode}`);
 * const token = await flow.waitForToken();
 * // Use token.accessToken with CopilotBackendOptions.githubToken
 * ```
 */
declare class CopilotAuth {
    private readonly fetchFn;
    /** @param options - Optional configuration with custom fetch for testing */
    constructor(options?: {
        fetch?: FetchFn$1;
    });
    /**
     * Start the GitHub Device Flow.
     * Returns a device code result with user code, verification URL,
     * and a `waitForToken()` function that polls until the user authorizes.
     *
     * @param options - Optional scopes and abort signal
     * @returns Device flow result with user code, verification URL, and waitForToken poller
     * @throws {AuthError} If the device code request fails
     * @throws {DeviceCodeExpiredError} If the device code expires before user authorizes
     * @throws {AccessDeniedError} If the user denies access
     *
     * @example
     * ```ts
     * const auth = new CopilotAuth();
     * const { userCode, verificationUrl, waitForToken } = await auth.startDeviceFlow();
     * console.log(`Open ${verificationUrl} and enter code: ${userCode}`);
     * const token = await waitForToken();
     * ```
     */
    startDeviceFlow(options?: {
        scopes?: string;
        signal?: AbortSignal;
    }): Promise<DeviceFlowResult>;
    private pollForToken;
    private fetchUserLogin;
    /**
     * Refresh an expired Copilot token using a refresh token.
     * Only works for GitHub App tokens that include a refresh_token.
     *
     * @param refreshToken - The refresh token from the original auth flow
     * @param signal - Optional abort signal
     * @returns Fresh CopilotAuthToken with new access and refresh tokens
     * @throws {TokenExchangeError} If the refresh request fails
     *
     * @example
     * ```ts
     * const auth = new CopilotAuth();
     * const newToken = await auth.refreshToken(oldToken.refreshToken!);
     * ```
     */
    refreshToken(refreshToken: string, signal?: AbortSignal): Promise<CopilotAuthToken>;
    private delay;
}

/** Fetch function type for dependency injection in tests */
type FetchFn = typeof globalThis.fetch;
/** Random bytes generator for dependency injection in tests */
type RandomBytesFn = (size: number) => Uint8Array;
/**
 * Programmatic OAuth+PKCE authentication for Claude SDK.
 *
 * @example
 * ```ts
 * const auth = new ClaudeAuth();
 * const { authorizeUrl, completeAuth } = auth.startOAuthFlow({
 *   redirectUri: "https://platform.claude.com/oauth/code/callback",
 * });
 * // Open authorizeUrl in browser, get code from redirect
 * const token = await completeAuth(code);
 * // Use token with ClaudeBackendOptions: env.CLAUDE_CODE_OAUTH_TOKEN
 * ```
 */
declare class ClaudeAuth {
    private readonly fetchFn;
    private readonly randomBytes;
    /**
     * @param options - Optional configuration with custom fetch and random bytes for testing
     */
    constructor(options?: {
        fetch?: FetchFn;
        randomBytes?: RandomBytesFn;
    });
    /**
     * Start the Claude OAuth+PKCE flow.
     * Generates PKCE code verifier/challenge and returns an authorize URL
     * plus a `completeAuth(code)` function for token exchange.
     *
     * @param options - Redirect URI and optional scopes
     * @returns OAuth flow result with authorize URL and completeAuth function
     * @throws {AuthError} If PKCE generation fails
     *
     * @example
     * ```ts
     * const auth = new ClaudeAuth();
     * const { authorizeUrl, completeAuth } = auth.startOAuthFlow({
     *   redirectUri: "https://platform.claude.com/oauth/code/callback",
     * });
     * console.log(`Open: ${authorizeUrl}`);
     * const token = await completeAuth(authorizationCode);
     * ```
     */
    startOAuthFlow(options?: OAuthFlowOptions): OAuthFlowResult;
    /**
     * Extract an authorization code from user input.
     * Accepts a raw code string or a full redirect URL containing a `code` query parameter.
     *
     * @param input - Raw authorization code or redirect URL
     * @returns The extracted authorization code
     *
     * @example
     * ```ts
     * ClaudeAuth.extractCode("abc123"); // "abc123"
     * ClaudeAuth.extractCode("https://platform.claude.com/oauth/code/callback?code=abc123&state=xyz"); // "abc123"
     * ```
     */
    static extractCode(input: string): string;
    /**
     * Refresh an expired Claude token.
     *
     * @param refreshToken - The refresh token from a previous authentication
     * @returns New auth token with refreshed access token
     * @throws {TokenExchangeError} If the refresh request fails
     *
     * @example
     * ```ts
     * const auth = new ClaudeAuth();
     * const newToken = await auth.refreshToken(oldToken.refreshToken);
     * ```
     */
    refreshToken(refreshToken: string): Promise<ClaudeAuthToken>;
    private generateCodeVerifier;
    private generateState;
    private buildAuthorizeUrl;
    private generateCodeChallengeSync;
    private exchangeCode;
    private mapTokenResponse;
}

export { ClaudeAuth, ClaudeAuthToken, CopilotAuth, CopilotAuthToken, DeviceFlowResult, OAuthFlowOptions, OAuthFlowResult };
