import { ApiClientConfig } from '../types.js';
export interface AuthConfig extends ApiClientConfig {
}
interface TokenData {
    access_token: string;
    refresh_token?: string;
    expires_in: number;
    expires_at: number;
    token_type: string;
}
interface ClientCredentialsConfig extends AuthConfig {
    clientSecret: string;
    authMethod: 'client-credentials';
}
interface OAuthAuthConfig extends AuthConfig {
    authMethod: 'oauth';
    authUrl: string;
    tokenUrl: string;
    redirectUrl: string;
    audience: string;
    clientId: string;
    orgId: string;
}
/**
 * Client credentials (2-legged) authentication for non-interactive use.
 * Exchanges client_id + client_secret for a Bearer token via Auth0's /oauth/token endpoint.
 *
 * Token resolution order (in priority):
 * 1. In-memory cache  (always checked first, no I/O)
 * 2. Disk cache       (if authCache === true and cache file exists and token not expired)
 * 3. Auth0 fetch      (last resort — saves result to in-memory and disk)
 */
export declare class ClientCredentialsAuth {
    config: ClientCredentialsConfig;
    private cachedToken;
    constructor(options: ApiClientConfig);
    /**
     * Get the path to the M2M token cache file for this client ID.
     */
    private get tokenCachePath();
    /**
     * Build configuration from command-line options
     */
    private buildConfig;
    /**
     * Get authentication headers for API requests
     */
    getAuthHeaders(signal?: AbortSignal): Promise<Record<string, string>>;
    /**
     * Load cached M2M token from disk. Returns null on cache miss or read error.
     */
    private loadCachedToken;
    /**
     * Save M2M token to disk cache with restricted permissions (0600).
     * Errors are swallowed with a warning so a write failure never blocks a CLI invocation.
     */
    private saveCachedToken;
    /**
     * Get a valid access token, fetching a new one if expired.
     * Checks in-memory cache first, then disk cache (if authCache is enabled), then Auth0.
     */
    private getAccessToken;
    /**
     * Check if token is expired (with 5 minute buffer)
     */
    private isTokenExpired;
}
/** Pass-through auth: attaches no headers (used when auth is injected downstream). */
export declare class NoAuth {
    config: AuthConfig;
    constructor(options: AuthConfig);
    getAuthHeaders(signal?: AbortSignal): Promise<Record<string, string>>;
}
/**
 * OAuth-based authentication (simplified version for now)
 */
export declare class GreprAuth {
    config: OAuthAuthConfig;
    constructor(options: ApiClientConfig);
    /**
     * Get the path to the token cache file
     */
    private get tokenCachePath();
    /**
     * Build configuration from command-line options
     */
    private buildConfig;
    /**
     * Get authentication headers for API requests (OAuth uses Bearer token)
     */
    getAuthHeaders(signal?: AbortSignal): Promise<Record<string, string>>;
    /**
     * Get a valid access token, refreshing if necessary
     */
    getAccessToken(signal?: AbortSignal): Promise<string>;
    /**
     * Perform fresh OAuth authentication and optionally cache the result
     */
    private performFreshAuthentication;
    /**
     * OAuth 2.0 PKCE flow with local callback server
     */
    authenticateWithPKCE(signal?: AbortSignal): Promise<TokenData>;
    /**
     * Generate PKCE code verifier and challenge
     */
    generatePKCEPair(): {
        codeVerifier: string;
        codeChallenge: string;
    };
    /**
     * Start local HTTP server to receive OAuth callback
     */
    startCallbackServer(expectedState: string, authUrl: string, signal?: AbortSignal): Promise<string>;
    /**
     * Exchange authorization code for access token
     */
    exchangeCodeForToken(authCode: string, codeVerifier: string, signal?: AbortSignal): Promise<TokenData>;
    /**
     * Refresh access token using refresh token
     */
    refreshToken(refreshToken: string, signal?: AbortSignal): Promise<TokenData>;
    /**
     * Load cached token from file system
     */
    loadCachedToken(): Promise<TokenData | null>;
    /**
     * Save token to cache
     */
    saveCachedToken(tokenData: TokenData): Promise<void>;
    /**
     * Check if token is expired (with 5 minute buffer)
     */
    isTokenExpired(tokenData: TokenData): boolean;
}
export {};
//# sourceMappingURL=auth.d.ts.map