import { ServiceResult } from './types.js';
import type { GitLabProviderConfig, AtlassianProviderConfig, GrafanaProviderConfig, McpLocalConfig } from '../../mcp/config/types.js';
import type { TokenStore } from '../../mcp/store/types.js';
/**
 * Download the MCP providers config from S3 to ~/.padua/mcp-providers.json.
 *
 * Non-blocking: callers must not fail the overall login flow on error.
 */
export declare function downloadProvidersConfig(profile: string): Promise<ServiceResult>;
/**
 * Authenticate to GitLab using the PKCE OAuth flow.
 *
 * Strategy: if a valid token already exists in the store, return immediately.
 * Otherwise run the full PKCE flow via OAuthTokenManager.authenticate().
 * The OAuthTokenManager handles token refresh internally via ensureFresh().
 *
 * Non-blocking: callers must not fail the overall login flow on error.
 */
export declare function authenticateGitLab(config: GitLabProviderConfig, tokenStore?: TokenStore): Promise<ServiceResult>;
/**
 * Authenticate to Atlassian using the confidential client OAuth flow.
 *
 * Strategy: if a valid token already exists in the store, return immediately.
 * Otherwise run the full OAuth flow via OAuthTokenManager.authenticate().
 *
 * Non-blocking: callers must not fail the overall login flow on error.
 */
export declare function authenticateAtlassian(config: AtlassianProviderConfig, tokenStore?: TokenStore): Promise<ServiceResult>;
/**
 * Authenticate to Grafana.
 *
 * Strategy when config.token is present (shared service-account token):
 *   1. Validate by calling GET ${config.baseUrl}/api/health with the token.
 *   2. On success: return success WITHOUT prompting and WITHOUT store.upsert.
 *      The daemon reads the token directly from the config.
 *   3. On validation failure: return { success: false, error }.
 *
 * Strategy when config.token is absent (interactive prompt path):
 *   1. Prompt the user for a SA token (masked input).
 *   2. Validate by calling GET ${config.baseUrl}/api/health with the token.
 *   3. On success: store via store.upsert('grafana', ...) and return success.
 *   4. On validation failure: return { success: false, error }.
 *
 * The token is NEVER logged or written to any log stream.
 *
 * Non-blocking: callers must not fail the overall login flow on error.
 */
export declare function authenticateGrafana(config: GrafanaProviderConfig, tokenStore?: TokenStore): Promise<ServiceResult>;
/**
 * Restart the MCP daemon unconditionally.
 *
 * Always stops any running daemon and forks a fresh one so the latest
 * installed binary is used.  This avoids stale processes lingering after
 * `npm install -g` upgrades.
 *
 * Non-blocking: callers must not fail the overall login flow on error.
 */
export declare function ensureMcpDaemon(mcpConfig?: McpLocalConfig): Promise<ServiceResult>;
//# sourceMappingURL=mcp-steps.d.ts.map