/**
 * OAuth 2.0 device-code client used by `lobu login`.
 *
 * Shared OAuth flow used by Lobu MCP clients against
 * Lobu-hosted issuers: dynamic client registration (RFC 7591) +
 * device authorization grant (RFC 8628) + refresh-token grant.
 */
export declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
export interface OAuthDiscovery {
    issuer: string;
    authorizationEndpoint?: string;
    tokenEndpoint: string;
    registrationEndpoint?: string;
    deviceAuthorizationEndpoint?: string;
    revocationEndpoint?: string;
    userinfoEndpoint?: string;
    grantTypesSupported: string[];
    /** auth.md `agent_auth.claim_email_endpoint` — present when the server supports the email user_claimed flow. */
    claimEmailEndpoint?: string;
}
export interface RegisteredClient {
    clientId: string;
    clientSecret?: string;
}
interface DeviceAuthorization {
    deviceCode: string;
    userCode: string;
    verificationUri: string;
    verificationUriComplete?: string;
    expiresIn: number;
    interval: number;
}
interface TokenResponse {
    accessToken: string;
    refreshToken?: string;
    expiresIn?: number;
    /**
     * RFC 8707 resource the issuer bound these tokens to, echoed back on the
     * token response. Persisted with the credential so every later refresh can
     * replay it — a resource-scoped grant refreshed without it is rejected.
     */
    resource?: string;
}
interface UserInfo {
    sub: string;
    email?: string;
    name?: string;
}
export declare class OAuthError extends Error {
    readonly code: string;
    constructor(code: string, message: string);
}
/**
 * Find the OAuth issuer for an API URL by stripping the path and fetching
 * `<origin>/.well-known/oauth-authorization-server`. Both Lobu-hosted
 * issuers (community.lobu.ai, app.lobu.ai) and the embedded local gateway
 * publish discovery at the API origin.
 */
export declare function discoverOAuth(apiUrl: string): Promise<OAuthDiscovery>;
/**
 * Register a public client capable of running the device-code grant.
 * `token_endpoint_auth_method: "none"` keeps the CLI from needing to
 * ship a client secret.
 */
export declare function registerClient(registrationEndpoint: string, softwareVersion: string): Promise<RegisteredClient>;
export declare function startDeviceAuthorization(endpoint: string, client: RegisteredClient): Promise<DeviceAuthorization>;
type DevicePollResult = {
    status: "pending";
    bumpInterval: boolean;
} | {
    status: "complete";
    tokens: TokenResponse;
} | {
    status: "error";
    code: string;
    message: string;
};
/**
 * One iteration of the device-code polling loop. Returns `pending` for
 * `authorization_pending` / `slow_down` (with `bumpInterval` set when the
 * server asks us to back off), `complete` once the user approves, and
 * `error` for terminal failures.
 */
export declare function pollDeviceToken(tokenEndpoint: string, client: RegisteredClient, deviceCode: string): Promise<DevicePollResult>;
/**
 * RFC 6749 §6 refresh grant. `options.resource` MUST carry the RFC 8707
 * indicator the grant was minted with: the Lobu issuer compares it against the
 * resource stored on the refresh row and answers `invalid_grant` when it is
 * absent or different, so a resource-scoped login cannot be renewed without it.
 */
export declare function refreshTokens(tokenEndpoint: string, client: RegisteredClient, refreshToken: string, options?: {
    resource?: string;
}): Promise<TokenResponse | null>;
export declare function fetchUserInfo(userinfoEndpoint: string, accessToken: string): Promise<UserInfo | null>;
/** RFC 7009 — best-effort. Network failures are intentionally swallowed. */
export declare function revokeToken(revocationEndpoint: string, client: RegisteredClient, token: string, hint: "access_token" | "refresh_token"): Promise<void>;
export declare function bumpInterval(interval: number, slowDown: boolean): number;
export {};
//# sourceMappingURL=oauth.d.ts.map