/**
 * OAuth 2.0 Device Authorization Grant (RFC 8628) client for `remixmate login`.
 *
 * The device/code and device/token endpoints are PUBLIC (no auth), so this uses
 * plain fetch against the ab-api base URL rather than the authenticated mmPost.
 * On approval the backend returns the user's existing PrivToken (Route B).
 */
export interface DeviceCodeResponse {
    deviceCode: string;
    userCode: string;
    verificationUri: string;
    verificationUriComplete?: string;
    interval: number;
    expiresIn: number;
}
/** Device-token poll sub-states (mirrors backend model.DeviceTokenStatus*). */
export type TokenStatus = 'authorization_pending' | 'slow_down' | 'approved' | 'access_denied' | 'expired_token' | 'invalid_grant';
export interface TokenResult {
    status: TokenStatus;
    privToken?: string;
    userLabel?: string;
    /**
     * Set when polling stopped because the caller-supplied `maxWaitMs` window
     * elapsed BEFORE the device code's own expiry. Lets callers distinguish a
     * short-wait timeout ("authorize then re-run") from a real expired code.
     */
    timedOut?: boolean;
}
export declare class DeviceFlowError extends Error {
}
/** Request a fresh device_code/user_code. 30s timeout, no retries here. */
export declare function requestDeviceCode(apiBaseUrl: string, clientLabel: string): Promise<DeviceCodeResponse>;
/**
 * Try to open `url` in the default browser. Returns false when no opener is
 * available (caller then prints the URL for manual entry).
 */
export declare function openBrowser(url: string): boolean;
/**
 * Poll device/token until a terminal outcome. Honors `interval` (+5s on
 * slow_down), retries transient network failures up to 3 consecutive times, and
 * bounds total time by the device code's `expiresIn`.
 *
 * When `opts.maxWaitMs` is supplied, polling also stops once that window
 * elapses (whichever comes first). A stop caused by `maxWaitMs` returns
 * `{ status: 'expired_token', timedOut: true }` so callers can tell a
 * short-wait timeout apart from a genuinely expired device code.
 *
 * Resolves with the final TokenResult (status 'approved' carries the token).
 */
export declare function pollForToken(apiBaseUrl: string, code: DeviceCodeResponse, opts?: {
    maxWaitMs?: number;
}): Promise<TokenResult>;