/**
 * Web OAuth sign-in routes for model providers (Settings › Providers).
 *
 * Wraps the SDK's step-based OAuth primitives (start/complete for Anthropic's
 * paste-code PKCE flow, start/poll for the Codex/Copilot/xAI device flows) in
 * HTTP routes. Flow state lives in login sessions — the `model-credentials`
 * domain's `oauth_login_sessions` table in tenant mode (any replica can
 * complete/poll), an in-memory store in local mode — so a flow can span
 * requests. Completed credentials are **user-scoped by default**; org admins
 * can start a flow with `{ scope: 'org' }` to share the credential with the
 * whole org. Local mode writes to the file-backed `AuthStorage`.
 *
 * Tokens never leave the server; responses only carry flow metadata (URLs,
 * user codes, poll delays).
 */
import type { AuthStorage } from '@mastra/code-sdk/auth/storage';
import type { ApiRoute } from '@mastra/core/server';
import { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
import type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';
import { Route } from './route.js';
import type { RouteDependencies } from './route.js';
export interface OAuthRoutesDeps extends RouteDependencies {
    /** File-backed credential store; used in local (no-auth) mode. */
    authStorage?: AuthStorage;
    /** Tenant credential domain handle; absent in local (no-DB) mode. */
    modelCredentials?: ModelCredentialsStorage;
    /** Personal OM settings; seeded from the login provider after a user-scoped sign-in. */
    memorySettings?: MemorySettingsStorage;
    /** Notifies the host after tenant credentials change so caches can be dropped. */
    onCredentialsChanged?: (tenant: {
        orgId: string;
        userId?: string;
    }) => void;
}
/**
 * Provider OAuth sign-in routes as Mastra `apiRoutes`:
 *   - `POST   /web/config/providers/:provider/oauth/start`              — begin a sign-in flow
 *   - `POST   /web/config/providers/:provider/oauth/complete`           — paste-code exchange
 *   - `POST   /web/config/providers/:provider/oauth/poll`               — one device-code poll
 *   - `DELETE /web/config/providers/:provider/oauth/session/:sessionId` — cancel a flow
 *   - `DELETE /web/config/providers/:provider/oauth`                    — sign out (caller only)
 */
export declare class OAuthRoutes extends Route<OAuthRoutesDeps> {
    routes(): ApiRoute[];
}
//# sourceMappingURL=oauth.d.ts.map