import type { OAuthCredentials } from "./types";
interface StartDeviceAuthorizationResponse {
    deviceCode: string;
    userCode: string;
    verificationUri: string;
    verificationUriComplete?: string;
    interval: number;
    expiresIn: number;
}
interface CreateTokenSuccess {
    accessToken: string;
    tokenType: string;
    expiresIn: number;
    refreshToken?: string;
}
interface ClientRegistration {
    clientId: string;
    clientSecret: string;
    expiresAt: number;
}
/**
 * Register a public SSO OIDC client. Registration responses include an expiry
 * timestamp (`clientSecretExpiresAt`); we cache until then to avoid re-registering
 * on every login attempt.
 *
 * The SSO OIDC `RegisterClient` endpoint is public (no authentication required).
 */
export declare function registerClient(region: string, startUrl: string, signal?: AbortSignal): Promise<ClientRegistration>;
/** Drop cached client registration — used by tests. */
export declare function clearClientRegistrationCache(): void;
/**
 * Start device authorization. The SSO OIDC `StartDeviceAuthorization` endpoint
 * is public (requires registered clientId/clientSecret, not SigV4).
 */
export declare function startDeviceAuthorization(region: string, startUrl: string, registration: ClientRegistration, signal?: AbortSignal): Promise<StartDeviceAuthorizationResponse>;
/**
 * Poll `CreateToken` until the user completes authorization or the device code
 * expires. Handles `authorization_pending` (continue polling) and `slow_down`
 * (increase interval) per the published SSO OIDC model.
 */
export declare function pollForToken(region: string, registration: ClientRegistration, deviceCode: string, intervalSeconds: number, expiresInSeconds: number, signal?: AbortSignal): Promise<CreateTokenSuccess>;
/**
 * Refresh an expired access token using the stored refresh token via
 * `CreateToken` with `grantType: "refresh_token"`.
 *
 * Rotation is published behavior: the response includes a new `refreshToken`.
 * If the server does not return a new one, the old refresh token is retained.
 */
export declare function refreshKiroToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
export interface KiroLoginOptions {
    onAuth: (url: string, instructions?: string) => void;
    onPrompt: (prompt: {
        message: string;
        placeholder?: string;
        allowEmpty?: boolean;
    }) => Promise<string>;
    onProgress?: (message: string) => void;
    signal?: AbortSignal;
    /** Override for tests. */
    fetchImpl?: typeof globalThis.fetch;
}
export declare function loginKiro(options: KiroLoginOptions): Promise<OAuthCredentials>;
/**
 * Attempt to import a cached SSO access token from `~/.aws/sso/cache/`.
 * Returns the token if a valid (non-expired) one exists, otherwise undefined.
 *
 * This reuses the documented AWS CLI SSO cache location, not any third-party
 * credential store.
 */
export declare function importSsoCacheToken(): OAuthCredentials | undefined;
export {};