/**
 * Shared Device Flow orchestration used by BOTH `remixmate login` (interactive,
 * full device-code lifetime) and the automatic browser auth that kicks in when
 * a skill call finds no token (bounded by a short wait window).
 *
 * Centralizing the request → open browser → poll → persist sequence keeps the
 * two entry points byte-for-byte consistent (Requirement 4.1/4.2) and means the
 * credential written by auto-login is indistinguishable from `login`'s.
 *
 * Security: the PrivToken value is NEVER written to the provided sink.
 */
import { type DeviceCodeResponse } from './device-flow.js';
export declare function renderAuthBlock(apiBaseUrl: string, code: DeviceCodeResponse): string;
/**
 * Emit the authorization prompt: a one-click link (device code pre-filled),
 * the manual fallback, and — for agent hosts — the machine-readable block.
 * Shared by `runDeviceFlow` and `login --start` so both entry points present
 * authorization identically.
 */
export declare function writeAuthPrompt(write: (msg: string) => void, apiBaseUrl: string, code: DeviceCodeResponse): void;
export interface DeviceFlowOptions {
    /**
     * Upper bound on how long to poll for approval. When omitted the device
     * code's own `expiresIn` is the only bound (used by interactive `login`).
     * When set (auto-login), a stop caused by this window is reported as
     * `'timeout'` rather than `'expired'`.
     */
    maxWaitMs?: number;
    /** Where human-facing progress text goes. Defaults to stderr. */
    write?: (msg: string) => void;
    /** Client label sent with the device-code request. */
    clientLabel?: string;
}
export type DeviceFlowOutcome = {
    status: 'approved';
    userLabel?: string;
} | {
    status: 'timeout';
} | {
    status: 'denied';
} | {
    status: 'expired';
} | {
    status: 'error';
    message: string;
};
/**
 * Persist an approved PrivToken. Shared by `runDeviceFlow` and `login --wait`
 * so a credential written by either is indistinguishable. The token value is
 * never written to `write`.
 */
export declare function persistApproval(apiBaseUrl: string, privToken: string, userLabel: string | undefined, write: (msg: string) => void): Promise<void>;
/**
 * Run one full Device Flow against `apiBaseUrl`. On approval the PrivToken is
 * persisted via setCredential (keychain or file, same as `login`) and only the
 * non-secret outcome is returned.
 */
export declare function runDeviceFlow(apiBaseUrl: string, opts?: DeviceFlowOptions): Promise<DeviceFlowOutcome>;