/**
 * GLM ZCode OAuth flow (UNOFFICIAL, opt-in).
 *
 * Replicates how the ZCode desktop app turns a Z.AI login into usable GLM model
 * access. This is NOT an official Z.AI OAuth client: it reuses ZCode's authorize
 * page, broker, and a custom-protocol redirect. It may break at any time and may
 * violate ZCode/Z.AI Terms of Service. Endpoints/client id are overridable via
 * `ZCODE_OAUTH_*` environment variables.
 *
 * Verified end-to-end against the ZCode host bundle (`resolveZaiApiKey` /
 * `resolveBizApiKey`) and live traffic:
 *   1. Authorize: GET {authorize}?redirect_uri=zcode://oauth/callback&response_type=code&client_id=...&state=...
 *      (custom-protocol redirect → a CLI cannot catch it, so the user pastes the code/redirect URL)
 *   2. Broker:    POST {broker} { provider:"zai", code, redirect_uri, state }
 *                  → { data: { token: <ZCode JWT>, zai: { access_token: <upstream Z.AI token> } } }
 *   3. Business:  POST {z/login} { token: <upstream Z.AI token> } → { data: { access_token: <business token> } }
 *   4. Provision: with the business token, GET getCustomerInfo → default org/project,
 *      GET/POST .../api_keys (find/create a key named "zcode-api-key"),
 *      GET .../api_keys/copy/{id} → secretKey ⇒ a real Z.AI API key "{id}.{secret}".
 *
 * Credential mapping:
 *   - `access`  = the provisioned **Z.AI API key** ("{id}.{secret}"). Model requests go to
 *                 `https://api.z.ai/api/anthropic/v1/messages` with `Authorization: Bearer <key>`
 *                 (exactly like a dashboard key) — NO zcode.z.ai gateway, NO captcha.
 *   - `refresh` = the upstream Z.AI OAuth access token (used to re-provision the key).
 * The API key is long-lived, so `expires` is set far in the future.
 *
 * This provider must NEVER force `isOAuth=true`: the key is a plain Z.AI API key, and
 * api.z.ai is not api.anthropic.com, so the Anthropic path already emits a plain bearer.
 */
import { OAuthCallbackFlow } from "./callback-server";
import type { OAuthController, OAuthCredentials } from "./types";
export declare const GLM_ZCODE_REFRESH_SKEW_MS: number;
/** Default endpoints / client id. Override via the matching `ZCODE_OAUTH_*` env vars. */
export declare const GLM_ZCODE_OAUTH_AUTHORIZE_URL = "https://chat.z.ai/api/oauth/authorize";
export declare const GLM_ZCODE_OAUTH_CLIENT_ID = "client_P8X5CMWmlaRO9gyO-KSqtg";
export declare const GLM_ZCODE_OAUTH_REDIRECT_URI = "zcode://oauth/callback";
export declare const GLM_ZCODE_OAUTH_BROKER_TOKEN_URL = "https://zcode.z.ai/api/v1/oauth/token";
export declare const GLM_ZCODE_ZAI_LOGIN_URL = "https://api.z.ai/api/auth/z/login";
export declare const GLM_ZCODE_USERINFO_URL = "https://chat.z.ai/api/oauth/userinfo";
/** Z.AI business API base (customer/org/project/api-key management). */
export declare const GLM_ZCODE_ZAI_API_BASE = "https://api.z.ai";
/** Model API base — the provisioned key is used here, exactly like a dashboard key. */
export declare const GLM_ZCODE_ANTHROPIC_BASE_URL = "https://api.z.ai/api/anthropic";
type FetchImpl = typeof globalThis.fetch;
/** Configured whenever a client id is available; the real ZCode client id ships as default. */
export declare function isGlmZcodeOAuthConfigured(): boolean;
export interface GlmZcodeOAuthFlowOptions {
    fetch?: FetchImpl;
}
export declare class GlmZcodeOAuthFlow extends OAuthCallbackFlow {
    #private;
    constructor(ctrl: OAuthController, options?: GlmZcodeOAuthFlowOptions);
    generateAuthUrl(state: string, redirectUri: string): Promise<{
        url: string;
        instructions?: string;
    }>;
    exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
}
export declare function loginGlmZcode(ctrl: OAuthController, options?: GlmZcodeOAuthFlowOptions): Promise<OAuthCredentials>;
export interface GlmZcodeRefreshOptions {
    signal?: AbortSignal;
    fetch?: FetchImpl;
}
/**
 * Re-provision the Z.AI API key from the stored upstream token. The key itself is
 * long-lived, so this is rarely needed; if the upstream token has expired it fails
 * loudly and the user must re-login.
 */
export declare function refreshGlmZcodeToken(credentials: OAuthCredentials, options?: AbortSignal | GlmZcodeRefreshOptions): Promise<OAuthCredentials>;
export {};