import type { NextApiRequest, NextApiResponse } from 'next';
import { NextRequest, NextResponse } from 'next/server';
import { SessionData, SessionOptions } from '@wristband/typescript-session';
import { NextJsCookieStore, ServerActionAuthResult, type AuthConfig, type AuthMiddlewareConfig, type CallbackResult, type LoginConfig, type LogoutConfig, type TokenData } from '../types';
import { WristbandAuth } from './wristband-auth';
/**
 * WristbandAuth is a utility class providing methods for seamless interaction with the Wristband authentication service.
 * @implements {WristbandAuth}
 */
export declare class WristbandAuthImpl implements WristbandAuth {
    private configResolver;
    private appRouterAuthHandler;
    private pagesRouterAuthHandler;
    private wristbandService;
    private jwtValidator?;
    /**
     * Creates an instance of WristbandAuth.
     *
     * @param {AuthConfig} authConfig The configuration for Wristband authentication.
     */
    constructor(authConfig: AuthConfig);
    /**
     * @see {@link WristbandAuth.appRouter}
     */
    appRouter: {
        /**
         * @see {@link WristbandAuth.appRouter} for full documentation
         */
        login: (request: NextRequest, loginConfig?: LoginConfig) => Promise<NextResponse>;
        /**
         * @see {@link WristbandAuth.appRouter} for full documentation
         */
        callback: (request: NextRequest) => Promise<CallbackResult>;
        /**
         * @see {@link WristbandAuth.appRouter} for full documentation
         */
        logout: (request: NextRequest, logoutConfig?: LogoutConfig) => Promise<NextResponse>;
        /**
         * @see {@link WristbandAuth.appRouter} for full documentation
         */
        createCallbackResponse: (request: NextRequest, redirectUrl: string) => Promise<NextResponse>;
        /**
         * @see {@link WristbandAuth.appRouter} for full documentation
         */
        createServerActionAuth: <T extends SessionData = SessionData>(config: {
            sessionOptions: SessionOptions;
        }) => ((cookieStore: NextJsCookieStore) => Promise<ServerActionAuthResult<T>>);
    };
    /**
     * @see {@link WristbandAuth.pagesRouter}
     */
    pagesRouter: {
        /**
         * @see {@link WristbandAuth.pagesRouter} for full documentation
         */
        login: (request: NextApiRequest, response: NextApiResponse, loginConfig?: LoginConfig) => Promise<string>;
        /**
         * @see {@link WristbandAuth.pagesRouter} for full documentation
         */
        callback: (request: NextApiRequest, response: NextApiResponse) => Promise<CallbackResult>;
        /**
         * @see {@link WristbandAuth.pagesRouter} for full documentation
         */
        logout: (request: NextApiRequest, response: NextApiResponse, logoutConfig?: LogoutConfig) => Promise<string>;
    };
    /**
     * @see {@link WristbandAuth.refreshTokenIfExpired}
     */
    refreshTokenIfExpired(refreshToken: string, expiresAt: number): Promise<TokenData | null>;
    /**
     * @see {@link WristbandAuth.createMiddlewareAuth}
     */
    createMiddlewareAuth<T extends SessionData = SessionData>(config: AuthMiddlewareConfig): (request: NextRequest, previousResponse?: NextResponse) => Promise<NextResponse>;
    /**
     * Lazily initializes and returns the JWT validator instance.
     * Only creates the validator on first use if JWT strategy is configured.
     */
    private getJwtValidator;
    /**
     * Attempts to authenticate a request using a single configured auth strategy.
     *
     * This evaluates the provided strategy in isolation and reports whether it
     * succeeded or failed with a specific reason. Normal authentication failures
     * are returned as structured results rather than thrown, allowing the caller
     * to orchestrate fallback strategies and proper HTTP error responses.
     *
     * @template T - Session data type extending SessionData
     * @param request - The incoming Next.js request to authenticate.
     * @param strategy - The auth strategy to apply for this attempt.
     * @param normalizedConfig - The fully normalized middleware configuration.
     * @param isProtectedApiRoute - Indicates whether the current path is a protected API route.
     * @returns A structured result describing authentication outcome, session (if successful), strategy used, and failure reason (if failed).
     */
    private tryAuthStrategy;
    /**
     * Creates the appropriate failure response based on the authentication failure reason
     * and whether the request is for an API route or page route.
     *
     * @param request - The incoming request
     * @param reason - Why authentication failed
     * @param isProtectedApiRoute - Whether this is a protected API route
     * @param normalizedConfig - The normalized middleware configuration
     * @returns NextResponse with appropriate status code or redirect
     */
    private getAuthFailureResponse;
}