import { type KiroAuthMethod } from "./config.js";
/**
 * Kiro OAuth.
 *
 * Two distinct backends, because Kiro's service only federates social logins:
 *   - Google / GitHub  -> Kiro desktop auth service, PKCE + localhost callback.
 *   - AWS Builder ID   -> AWS SSO OIDC device-code flow.
 * Each mints its own credential shape and refreshes through its own endpoint.
 */
export interface KiroTokens {
    access: string;
    refresh: string;
    /** Epoch millis. */
    expires: number;
    authMethod: KiroAuthMethod;
    /** CodeWhisperer profile ARN issued with social tokens. */
    profileArn?: string;
    region: string;
    /** IdC only: needed to refresh through SSO OIDC. */
    clientId?: string;
    clientSecret?: string;
    /** Account email, when the provider discloses it. */
    email?: string;
}
export interface LoginCallbacks {
    onAuth(info: {
        url: string;
        instructions?: string;
    }): void;
    onDeviceCode?(info: {
        userCode: string;
        verificationUri: string;
    }): void;
    onProgress?(message: string): void;
    onPrompt(prompt: {
        message: string;
        placeholder?: string;
    }): Promise<string>;
    onSelect?(prompt: {
        message: string;
        options: {
            id: string;
            label: string;
        }[];
    }): Promise<string | undefined>;
    signal?: AbortSignal;
}
export declare class KiroAuthError extends Error {
    readonly permanent: boolean;
    readonly status?: number;
    constructor(message: string, options?: {
        permanent?: boolean;
        status?: number;
        cause?: unknown;
    });
}
export interface KiroUsage {
    email?: string;
    usedCount: number;
    limitCount: number;
    /** Subscription tier, e.g. "KIRO PRO MAX". */
    plan?: string;
    /** Epoch millis when the allowance resets. */
    resetAt?: number;
}
/**
 * Read the account's credit allowance.
 *
 * The response carries per-resource rows in `usageBreakdownList`, *not*
 * top-level `usedCount`/`limitCount` fields. Reading only the top level yielded
 * 0/0 for every account and made this look like an unmetered plan, which
 * silently disabled usage-aware placement. The real numbers live in the `CREDIT`
 * row's `*WithPrecision` fields, which match what the Kiro account page shows
 * (e.g. 0.58 used / 5000 covered, resetting on the 1st).
 *
 * Drives both the usage dashboard and usage-aware placement. Callers treat a
 * throw as "unknown headroom" rather than an error, so this never blocks a
 * request.
 */
export declare function fetchKiroUsage(tokens: Pick<KiroTokens, "access" | "region">, fetchImpl?: typeof fetch): Promise<KiroUsage>;
/** Run the Kiro login flow, asking which sign-in method to use. */
export declare function loginKiro(callbacks: LoginCallbacks, method?: KiroAuthMethod): Promise<KiroTokens>;
/** Refresh Kiro tokens through whichever backend issued them. */
export declare function refreshKiro(tokens: KiroTokens): Promise<KiroTokens>;