import { type LoginRunnerDisposable, type LoginRunnerLifecycleOptions, type LoginRunnerOutcome, type LoginRunnerResult } from "@penclipai/adapter-utils";
import { type SetupTokenPrompt } from "./setup-token-parse.js";
/** The fixed Claude setup-token command. The login flow needs a PTY. */
export declare const CLAUDE_SETUP_TOKEN_COMMAND = "claude setup-token";
/**
 * The submission terminator for the browser code. The interactive login UI reads
 * the code on a PTY and submits it on a carriage return. The runner writes this
 * terminator as its own write, after the code write and a short settle delay.
 * The live characterization showed that a single write of `code + "\r"` does not
 * submit: the input is an Ink text field with paste handling, so a glued
 * carriage return folds into the pasted text instead of a Return key, and the
 * login stalls at the prompt. Two writes with a settle gap submit on the first
 * Return.
 */
export declare const CODE_SUBMISSION_TERMINATOR = "\r";
/**
 * The default settle delay in milliseconds between the code write and the
 * terminator write. The delay lets the Ink paste buffer settle, so the terminator
 * arrives as a distinct Return key. A caller can override it; a test sets it to 0.
 */
export declare const CODE_SUBMIT_SETTLE_MS = 150;
/**
 * The maximum number of characters the runner keeps for the next chunk. The
 * login prompt is small and puts the URL and the prompt line close together. A
 * sandbox can stream a large volume of output before the prompt. So after each
 * parse the runner keeps only the most recent characters up to this limit. The
 * retained buffer cannot grow without a bound across many chunks. The limit is
 * far larger than the prompt, so the trailing window never drops a real prompt
 * that spans a chunk boundary.
 */
export declare const CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS: number;
/**
 * The child side of the setup-token run. The runner never spawns the PTY
 * directly; a caller injects a concrete driver. A production driver binds these
 * methods to a PTY child that runs {@link CLAUDE_SETUP_TOKEN_COMMAND}.
 */
export interface SetupTokenPtyDriver extends LoginRunnerDisposable {
    /**
     * Starts `command` in a PTY and streams the terminal output to `onData` in
     * memory. Resolves with the child exit code when the child ends. A driver must
     * not persist the raw output to any durable log.
     */
    start(command: string, onData: (chunk: string) => void): Promise<{
        exitCode: number | null;
    }>;
    /**
     * Writes `input` to the child PTY. The runner writes the browser code plus the
     * submission terminator one time, only after it matches the prompt.
     */
    write(input: string): void;
    /**
     * Stops the child process with a direct child stop. The characterization showed
     * that the child needs `SIGKILL`. The method must be safe to call before start
     * and safe to call more than one time.
     */
    stop(): void;
}
/** Receives the parsed prompt one time in memory. The caller displays it. */
export type SetupTokenPromptSink = (prompt: SetupTokenPrompt) => void;
/**
 * Returns the one browser code the user pastes from the sign-in page. The runner
 * calls it one time, only after it surfaces the prompt. The runner passes an
 * abort signal, so the provider can stop when the runner cancels or times out.
 */
export type SetupTokenCodeProvider = (signal: AbortSignal) => Promise<string>;
/**
 * Receives the credential bytes one time in memory on success. The runner binds
 * the token from the success record, then it awaits this sink one time with the
 * token bytes. The sink is mandatory and it returns a promise; the runner awaits
 * that promise before it reports success. A sink rejection ends the run as a
 * failure. The runner never logs the bytes and never stores them on the result.
 */
export type SetupTokenCredentialSink = (authBytes: Buffer) => Promise<void>;
/** The setup-token runner outcome. It is a fixed, non-secret status. */
export type SetupTokenOutcome = LoginRunnerOutcome;
/**
 * The runner result. It never carries a URL, a code, or a token byte. It extends
 * the base result with the two setup-token status fields.
 */
export interface SetupTokenLoginResult extends LoginRunnerResult {
    codeSubmitted: boolean;
    /** True when the runner bound the token and invoked `onCredential` one time. */
    credentialDelivered: boolean;
}
export interface RunSetupTokenLoginOptions extends LoginRunnerLifecycleOptions {
    /** The login command. Defaults to {@link CLAUDE_SETUP_TOKEN_COMMAND}. */
    command?: string;
    /** Receives the parsed prompt one time in memory. The caller displays it. */
    onPrompt: SetupTokenPromptSink;
    /** Returns the one browser code. The runner writes it to the matched prompt. */
    provideCode: SetupTokenCodeProvider;
    /**
     * The credential sink. The runner awaits it one time with the token bytes and
     * reports success only after it resolves. The sink is mandatory for a
     * successful run: a missing sink ends the run as a failure. The option stays
     * optional so a caller can drive a fail-closed path with no sink.
     */
    onCredential?: SetupTokenCredentialSink;
    /**
     * The settle delay in milliseconds between the code write and the terminator
     * write. Defaults to {@link CODE_SUBMIT_SETTLE_MS}. A test sets it to 0.
     */
    codeSubmitSettleMs?: number;
}
/**
 * Runs the setup-token login through `driver`. Surfaces the prompt one time
 * through `onPrompt`. Reads the browser code one time through `provideCode` and
 * writes it to the matched prompt. Binds the minted token from the success
 * record and delivers it one time through `onCredential`. Returns a fixed status.
 * Stops the child and disposes the driver for every terminal state. Never logs
 * the raw stream, and never puts a URL, a code, or a token into a log line, the
 * result, or a thrown error.
 */
export declare function runSetupTokenLogin(driver: SetupTokenPtyDriver, options: RunSetupTokenLoginOptions): Promise<SetupTokenLoginResult>;
//# sourceMappingURL=setup-token-runner.d.ts.map