import { type ITelemetryService } from "@cline/shared";
import type { OAuthCredentials, OAuthLoginCallbacks } from "./types";
export type ClineTokenResolution = {
    forceRefresh?: boolean;
    refreshBufferMs?: number;
    retryableTokenGraceMs?: number;
};
interface ClineAuthApiUser {
    subject: string | null;
    email: string;
    name: string;
    clineUserId: string | null;
    accounts: string[] | null;
}
type HeaderMap = Record<string, string>;
type HeaderInput = HeaderMap | (() => Promise<HeaderMap> | HeaderMap);
export interface ClineOAuthProviderOptions {
    apiBaseUrl: string;
    headers?: HeaderInput;
    requestTimeoutMs?: number;
    telemetry?: ITelemetryService;
    useWorkOSDeviceAuth?: boolean;
    callbackPath?: string;
    callbackPorts?: number[];
    /**
     * Optional identity provider name for token exchange.
     */
    provider?: string;
}
export interface ClineOAuthCredentials extends OAuthCredentials {
    metadata?: {
        provider?: string;
        tokenType?: string;
        userInfo?: ClineAuthApiUser;
        [key: string]: unknown;
    };
}
export declare function loginClineOAuth(options: ClineOAuthProviderOptions & {
    callbacks: OAuthLoginCallbacks;
}): Promise<ClineOAuthCredentials>;
export declare function startClineDeviceAuth(options?: {
    requestTimeoutMs?: number;
}): Promise<{
    deviceCode: string;
    userCode: string;
    verificationUri: string;
    verificationUriComplete?: string;
    expiresInSeconds: number;
    pollIntervalSeconds: number;
}>;
export declare function completeClineDeviceAuth(options: {
    deviceCode: string;
    expiresInSeconds: number;
    pollIntervalSeconds: number;
    apiBaseUrl: string;
    provider?: string;
    headers?: HeaderInput;
    requestTimeoutMs?: number;
    telemetry?: ITelemetryService;
}): Promise<ClineOAuthCredentials>;
export declare function refreshClineToken(current: ClineOAuthCredentials, options: ClineOAuthProviderOptions): Promise<ClineOAuthCredentials>;
/**
 * Resolve valid Cline credentials, refreshing when needed.
 *
 * Contract: returns refreshed/current credentials when usable; returns `null`
 * ONLY when the refresh token was rejected (invalid grant — re-auth required);
 * THROWS on transient failures (network, timeout, 5xx) so callers can leave
 * stored credentials untouched and retry later.
 */
export declare function getValidClineCredentials(currentCredentials: ClineOAuthCredentials | null, providerOptions: ClineOAuthProviderOptions, options?: ClineTokenResolution): Promise<ClineOAuthCredentials | null>;
export {};