/**
 * Reviewer auth-helper server (0.6.0) — multi-person LCR review.
 *
 * GitHub's device-flow token endpoints (github.com/login/device/code +
 * /login/oauth/access_token) are NOT CORS-accessible from a browser, so the
 * overlay can't run the device dance itself. This tiny server (started by
 * run-mock in `review_mode: lcr`) does the two server-side hops on the
 * overlay's behalf and nothing else.
 *
 * Crucially it is SAFE TO EXPOSE off-host (unlike gh-proxy, which injects the
 * host's own token): it only forwards the PUBLIC client-id + a per-session
 * device code to GitHub's public device endpoints. The reviewer's resulting
 * access token is returned to whoever completed the GitHub consent — the host
 * never sees a privileged secret. So for the remote-box case it binds 0.0.0.0;
 * for local use, 127.0.0.1.
 *
 * Endpoints (all JSON, permissive CORS):
 *   POST /__slowcook/auth/device  → { userCode, verificationUri, deviceCode, intervalSeconds, expiresInSeconds }
 *   POST /__slowcook/auth/poll    { deviceCode } → PollResult
 *   GET  /__slowcook/auth/health  → { ok: true, clientIdSuffix }
 */
import { type IncomingMessage, type ServerResponse } from "node:http";
import type { ForgeReviewerAuth } from "@slowcook-ai/core";
export interface AuthServerHandle {
    url: string;
    port: number;
    close: () => void;
}
/** Build the request handler (exported so it can be unit-tested without a socket). */
export declare function makeAuthHandler(auth: ForgeReviewerAuth, clientIdSuffix: string): (req: IncomingMessage, res: ServerResponse) => void;
/**
 * Start the auth helper. `host` defaults to 127.0.0.1; pass "0.0.0.0" for the
 * remote-box case so a co-worker's browser can reach it.
 */
export declare function startReviewerAuthServer(auth: ForgeReviewerAuth, opts: {
    clientId: string;
    preferredPort?: number;
    host?: string;
}): Promise<AuthServerHandle>;
//# sourceMappingURL=reviewer-auth-server.d.ts.map