import { type AgentProvider, type AgentMessage, type ProviderRunOptions } from '@duckcodeailabs/dql-agent';
import { type ClaudeOAuthCredentials } from './oauth-store.js';
/**
 * Claude Pro/Max subscription login via OAuth 2.0 + PKCE, and a provider that
 * drives `api.anthropic.com` with the resulting bearer token (no API key).
 *
 * Ported from the reference coding-extension flow. Tokens are stored in the
 * `chmod 600` `.dql/oauth-credentials.json` file rather than VSCode secrets.
 *
 * NOTE (governance / ToS): this reuses the official Claude Code OAuth client id
 * to authenticate a user's *subscription*. It is subject to Anthropic's terms —
 * the client id can be revoked and accounts can be rate-limited/flagged. The
 * provider falls back to the CLI-passthrough path when not connected.
 */
export declare const CLAUDE_OAUTH_CONFIG: {
    readonly authorizationEndpoint: "https://claude.ai/oauth/authorize";
    readonly tokenEndpoint: "https://console.anthropic.com/v1/oauth/token";
    readonly clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
    readonly redirectUri: "http://localhost:54545/callback";
    readonly scopes: "org:create_api_key user:profile user:inference";
    readonly callbackPort: 54545;
};
/** Claude subscription models exposed after login (latest generation; default first). */
export declare const CLAUDE_OAUTH_MODELS: readonly ["claude-sonnet-5", "claude-opus-4-8", "claude-haiku-4-5"];
export declare const CLAUDE_OAUTH_DEFAULT_MODEL = "claude-sonnet-5";
export declare function generateCodeVerifier(): string;
export declare function generateCodeChallenge(verifier: string): string;
export declare function generateState(): string;
/** Claude Code identifies the caller with a synthetic `user_<hash>_account_<uuid>_session_<uuid>` id. */
export declare function generateUserId(email?: string): string;
export declare function buildAuthorizationUrl(codeChallenge: string, state: string): string;
export declare function exchangeCodeForTokens(code: string, codeVerifier: string, state: string): Promise<ClaudeOAuthCredentials>;
export declare function refreshAccessToken(credentials: ClaudeOAuthCredentials): Promise<ClaudeOAuthCredentials>;
export declare function isTokenExpired(credentials: ClaudeOAuthCredentials): boolean;
/**
 * Project-scoped manager: owns the pending-auth state during a login and the
 * lazy access-token refresh. File-backed, so the login flow (backend endpoints)
 * and the provider (`generate`) see the same credentials.
 */
export declare class ClaudeOAuthManager {
    private readonly projectRoot;
    private pendingAuth;
    private refreshPromise;
    constructor(projectRoot: string);
    cancelAuthorizationFlow(): void;
    /** True while a login is in flight (callback server listening). */
    isPending(): boolean;
    startAuthorizationFlow(): string;
    /** Starts the loopback callback server on the fixed OAuth port and resolves when the browser returns. */
    waitForCallback(): Promise<ClaudeOAuthCredentials>;
    /** Returns a valid access token, refreshing (and persisting) if within the expiry buffer. */
    getAccessToken(): Promise<string | null>;
    getEmail(): string | null;
    isAuthenticated(): Promise<boolean>;
    signOut(): void;
}
/** True if a Claude subscription is connected (a credential exists on disk). */
export declare function claudeOAuthConnected(projectRoot: string): boolean;
/**
 * AgentProvider that drives Claude via the subscription OAuth token. Requires a
 * prior `Sign in with Claude`. The "You are Claude Code…" system preamble and the
 * `oauth-2025-04-20` beta header are required for the subscription API to accept
 * the request.
 */
export declare class ClaudeOAuthProvider implements AgentProvider {
    readonly name: "claude";
    private readonly manager;
    private readonly projectRoot;
    private readonly defaultModel;
    private readonly maxTokens;
    private readonly cliModel?;
    private cliFallback?;
    constructor(opts: {
        projectRoot: string;
        model?: string;
    });
    available(): Promise<boolean>;
    generate(messages: AgentMessage[], options?: ProviderRunOptions): Promise<string>;
}
//# sourceMappingURL=claude-oauth.d.ts.map