/**
 * `agent-native connect <url>` — wire your local MCP-capable coding agent
 * to a DEPLOYED agent-native app. OAuth-capable clients receive a standard
 * remote MCP URL entry and authenticate in the host. Fallback clients use the
 * browser device-code flow: open the verification URL, approve in the browser,
 * and the minted HTTP MCP server entry is written idempotently.
 *
 *   agent-native connect <url> [--client all|claude-code|
 *                               codex|cowork|cursor|opencode|github-copilot]
 *                               [--scope user|project]
 *                               [--name <serverName>]
 *   agent-native reconnect [<url>] [--client ...] [--name <serverName>]
 *   agent-native connect <url> --token <token>   (no-browser fallback)
 *   agent-native connect        [--client ...]   (pick first-party apps)
 *   agent-native connect --all  [--client ...]   (separate first-party app MCP resources)
 *
 * Server contract (implemented by another agent on `<url>`):
 *   POST <url>/mcp/connect/device/start  (no auth)
 *     body { client?, app? }
 *     → { device_code, user_code, verification_uri,
 *         verification_uri_complete, interval, expires_in }
 *   POST <url>/mcp/connect/device/poll   (no auth)
 *     body { device_code }
 *     → { status: "pending" }
 *     | { status: "approved", token, mcpUrl, serverName, mcpServerEntry }
 *     | { status: "expired" }
 *     | { status: "consumed" }
 *     | { status: "error" | "not_found", message? }
 *
 * Node-only CLI module. Uses Node built-ins, @clack/prompts, and global fetch.
 */
import { ClientId } from "./mcp-config-writers.js";
export interface ParsedConnectArgs {
    /** Developer profile switch: local dev gateway or saved production config. */
    mode?: "dev" | "prod" | "reauth" | "reconnect";
    /** Positional URL (the deployed app origin). Undefined for `--all`. */
    url?: string;
    /** all | claude-code | codex | cowork | cursor | opencode | github-copilot (default "all"). claude-code-cli is accepted as a legacy alias for claude-code. */
    client: string;
    /** True when the user passed --client explicitly, so we skip the picker. */
    clientExplicit: boolean;
    /** user | project (default "user"). */
    scope: string;
    /** Override the minted MCP server name. */
    name?: string;
    /** No-browser fallback: skip device flow, use this token directly. */
    token?: string;
    /**
     * Mint an ORG SERVICE token with this service name (e.g. "ci") instead of
     * writing local MCP configs. Authenticates the human via the device flow,
     * then calls the app's `create-org-service-token` action and prints the
     * token once — for CI secrets like PLAN_RECAP_TOKEN.
     */
    serviceToken?: string;
    /** Optional token TTL in days (1–365) for --service-token. */
    ttlDays?: number;
    /** Connect every first-party hosted app. */
    all: boolean;
    /** Comma-separated app names for profile switching. */
    apps?: string;
    /** Local dev-lazy gateway URL for `connect dev`. */
    gateway?: string;
    /** Shorthand for a local dev-lazy gateway port. */
    port?: number;
    /** Local owner email override for dev entries. */
    ownerEmail?: string;
    /**
     * Embed `catalog_scope: "full"` in the minted token so the connected client
     * bypasses the connector-catalog tier and sees the complete action surface.
     * Matches the `fullCatalog` body param on the app's token-mint route.
     */
    fullCatalog?: boolean;
}
export declare function parseConnectArgs(argv: string[]): ParsedConnectArgs;
/**
 * Normalize a user-supplied app URL: trim, require http/https, strip the
 * trailing slash. Throws a friendly Error otherwise.
 */
export declare function normalizeUrl(raw: string): string;
/** Resolve the requested clients list. "all" → every supported client. */
export declare function resolveClients(client: string): ClientId[];
export declare function connectPreferencesPath(): string;
export declare function readConnectClientPreferences(file?: string): ClientId[] | null;
export declare function writeConnectClientPreferences(clients: ClientId[], file?: string): void;
export interface ConnectClientPromptContext {
    initialClients: ClientId[];
    options: {
        value: ClientId;
        label: string;
        hint: string;
    }[];
    preferencesFile: string;
}
export interface HostedApp {
    name: string;
    label: string;
    url: string;
}
export interface ConnectHostedAppsPromptContext {
    apps: HostedApp[];
    initialApps: string[];
}
export declare function supportsRemoteMcpOAuth(client: ClientId): boolean;
/** Injectable hooks so the poll state machine is unit-testable. */
export interface ConnectDeps {
    /** Defaults to global fetch. */
    fetchImpl?: typeof fetch;
    /** Sleep between polls (ms). Defaults to real setTimeout. */
    sleep?: (ms: number) => Promise<void>;
    /** Open the verification URL. Defaults to the platform browser opener. */
    openBrowser?: (url: string) => void | Promise<void>;
    /** Optional wrapper for showing progress while the browser opener runs. */
    withBrowserOpenSpinner?: (message: string, openBrowser: () => void | Promise<void>) => void | Promise<void>;
    /** Override "now" for the expiry cap (ms epoch). Defaults to Date.now. */
    now?: () => number;
    /** Tests/embedders can force or suppress the interactive client picker. */
    isInteractive?: () => boolean;
    /** Injectable client picker. Defaults to @clack/prompts multiselect. */
    promptClients?: (context: ConnectClientPromptContext) => Promise<ClientId[] | null>;
    /** Injectable hosted app picker. Defaults to @clack/prompts multiselect. */
    promptHostedApps?: (context: ConnectHostedAppsPromptContext) => Promise<string[] | null>;
    /** Override the persisted connect preferences file. */
    preferencesFile?: string;
    /** Override the saved dev/prod profile file. */
    profilesFile?: string;
    /** Optional output hooks used when another clack-based command embeds connect. */
    logOut?: (message: string) => void;
    logErr?: (message: string) => void;
}
/**
 * Run the device-code flow against `baseUrl` and return the approved grant.
 * Resolves with `null` (and prints a clear message) on expired/consumed or
 * other terminal failure — the caller maps that to a non-zero exit.
 */
export declare function runDeviceFlow(baseUrl: string, appSlug: string, clientArg: string, deps?: ConnectDeps, options?: {
    fullCatalog?: boolean;
}): Promise<{
    token?: string;
    mcpUrl: string;
    serverName: string;
    headers?: Record<string, string>;
} | null>;
/**
 * Write the HTTP MCP entry into every requested client config idempotently.
 * Returns the list of files written so the caller can print them.
 */
export declare function writeConfigs(clients: ClientId[], serverName: string, mcpUrl: string, token: string | undefined, scope: string, baseDir?: string, headers?: Record<string, string>): {
    client: ClientId;
    file: string;
}[];
export declare function connectProfilesPath(): string;
/** Hosted first-party apps: visible (non-hidden) templates with a prodUrl. */
export declare function hostedApps(): HostedApp[];
/**
 * `agent-native connect <url> --service-token <name>` — mint an ORG service
 * token for CI (e.g. the PLAN_RECAP_TOKEN GitHub secret).
 *
 * Flow: authenticate the human via the existing browser device flow, then use
 * that short-lived grant to call the app's `create-org-service-token` action
 * (org owner/admin gated server-side). The service token is printed exactly
 * once and never written to any local config file.
 */
export declare function runServiceTokenMint(parsed: ParsedConnectArgs, deps?: ConnectDeps): Promise<boolean>;
/**
 * `agent-native connect` entry point. `deps` is injectable for tests; the
 * dispatcher in index.ts calls it with just `args`.
 *
 * Sets `process.exitCode = 1` on failure (so the process exits non-zero
 * once the event loop drains) rather than calling `process.exit`, keeping
 * the function testable — same pattern as `audit-agent-web`.
 */
export declare function runConnect(args: string[], deps?: ConnectDeps): Promise<void>;
//# sourceMappingURL=connect.d.ts.map