/**
 * `/api/dashboard/auth/github/*` — GitHub OAuth Device Flow as the
 * primary dashboard sign-in. The token-paste path
 * (`/api/dashboard/auth/login`) stays for self-hosters who don't want
 * to point GitHub at their box; both routes mint the same kind of
 * `cortex_dash_sid` cookie + SessionState binding.
 *
 * Why device flow rather than web flow:
 *   - No client secret required — the OneNomad-published OAuth app
 *     ships with the binary, no per-self-hoster setup.
 *   - The browser polls our `/poll` endpoint while showing a spinner
 *     + the short user code. No callback handler, no CSRF window, no
 *     URL state to misroute.
 *   - Self-hosters who do want a web flow set
 *     `PRZM_CORTEX_GITHUB_OAUTH_CLIENT_ID` + `_SECRET` in their workspace
 *     env; the `/callback` stub returns 501 with that exact hint until
 *     the lead lands the secret-bearing flow.
 *
 * Allowlist gate: only users whose GitHub login appears in
 * `PRZM_CORTEX_DASHBOARD_GITHUB_ALLOWLIST` (comma-separated,
 * case-insensitive) can sign in. Default is empty → fail-closed. The
 * operator opens up the dashboard explicitly. Avoid burning a session
 * + cookie on a denied login: the device flow already authenticated
 * with GitHub, so we know who the user is — they just don't get past
 * our gate.
 *
 * Surface:
 *   POST /api/dashboard/auth/github/start                       → 200 { userCode, verificationUri, pollKey, intervalMs, expiresInMs }
 *   POST /api/dashboard/auth/github/poll   { pollKey }          → 200 { status, ... }
 *   GET  /api/dashboard/auth/github/callback?code=&state=       → 501 (stub)
 */
import type { IncomingMessage, ServerResponse } from "node:http";
import type { RouteContext } from "../route-context.js";
/** Test seam — drop every in-flight grant + bucket. */
export declare function _resetPendingGrants(): void;
/**
 * Test-deps surface. The route layer reads from real GitHub + the live
 * workspace by default; tests inject mocks via these knobs.
 */
export interface GitHubAuthDeps {
    fetchImpl?: typeof fetch;
    resolveWorkspace?: () => Promise<{
        slug: string;
        envPath: string;
        path: string;
        configPath: string;
    } | undefined>;
    /** Override env lookup for the allowlist check — defaults to process.env. */
    envLookup?: (name: string) => string | undefined;
    /** Override the per-flow workspace env (allowlist + OAuth client id live here). */
    envParser?: (envPath: string) => ReadonlyMap<string, string>;
}
/**
 * Dispatcher for the github-auth namespace. Mirrors `dashboardAuthHandle`
 * so server.ts can just add this to the ROUTES array.
 */
export declare function buildHandle(deps?: GitHubAuthDeps): (req: IncomingMessage, res: ServerResponse, ctx: RouteContext) => Promise<boolean>;
/** Default handler — bound to live deps. Registered in `server.ts`. */
export declare const handle: (req: IncomingMessage, res: ServerResponse, ctx: RouteContext) => Promise<boolean>;
//# sourceMappingURL=dashboard-auth-github.d.ts.map