import type { OAuthCredentials, OAuthLoginCallbacks } from "./contracts-core.js";
/**
 * Shared RFC 8628 device-code flow used by both the OpenAI Codex OAuth provider
 * (provider-openai) and the generic OAuth 2.0 provider (credentials-node).
 * Owns the device-code request, the poll loop (authorization_pending continue,
 * slow_down backoff, expiry deadline), cancellation, bounded success/error
 * body reads, secret redaction, and token-shape parsing. Adapter-specific
 * fields are parameters/callbacks, not subclasses.
 */
export declare const REDACTED = "[REDACTED]";
export declare const DEFAULT_DEVICE_POLL_INTERVAL_MS = 5000;
export declare const SLOW_DOWN_INCREMENT_MS = 5000;
export interface OAuthDeviceCodePayload {
    readonly device_code: string;
    readonly user_code: string;
    readonly verification_uri: string;
    readonly verification_uri_complete?: string;
    readonly expires_in?: number;
    readonly interval?: number;
}
export interface OAuthTokenSuccessPayload {
    readonly access_token?: string;
    readonly refresh_token?: string;
    readonly expires_in?: number;
    readonly account_id?: string;
}
export interface OAuthTokenErrorPayload {
    readonly error?: string;
    readonly error_description?: string;
}
export interface PollDeviceCodeTokenOptions {
    readonly fetchImpl: typeof fetch;
    readonly deviceCodeUrl: string;
    readonly tokenUrl: string;
    readonly clientId: string;
    readonly scope?: string;
    /** Extra token-request params merged into every poll body (e.g. client_secret, audience). Never logged. */
    readonly extraTokenParams?: Readonly<Record<string, string>>;
    /** Extra device-code params merged into the device-code body only (e.g. referrer). Never logged. */
    readonly extraDeviceParams?: Readonly<Record<string, string>>;
    /** Wire encoding for device-code and token POSTs. Default `json` keeps Codex / M365 callers byte-compatible. */
    readonly bodyEncoding?: "json" | "form";
    readonly callbacks?: Pick<OAuthLoginCallbacks, "onDeviceCode" | "signal">;
    /** Message prefix, e.g. "OpenAI" or the adapter id. */
    readonly errorPrefix: string;
    /** Test seam: override wall clock for device-code expiry. */
    readonly now?: () => number;
    /** Test seam: override poll delay between device-code token requests. */
    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
    /** Token-shape parsing; adapter-specific fields (e.g. accountId fallback) applied here. */
    readonly parseTokenCredentials: (json: OAuthTokenSuccessPayload) => OAuthCredentials;
}
export declare function throwIfAborted(signal?: AbortSignal): void;
export declare function abortableSleep(ms: number, signal?: AbortSignal): Promise<void>;
export declare function redactOAuthError(error: Error, secrets: readonly (string | undefined)[]): Error;
/**
 * Request a device code, surface it through `onDeviceCode`, then poll the token
 * endpoint until success, expiry, a terminal OAuth error, or abort. All response
 * bodies are read under the shared byte ceiling; success bodies must be bounded
 * JSON with an `access_token` string (fail closed otherwise); error bodies are
 * bounded text parsed as JSON with a redacted-text fallback.
 */
export declare function pollDeviceCodeToken(options: PollDeviceCodeTokenOptions): Promise<OAuthCredentials>;