/**
 * Browser-based connect flow — the recommended provisioning path.
 *
 * 1. Start a local HTTP server on an ephemeral port.
 * 2. Build `{podUrl}/admin/connect?integration=cli&redirect_uri=http://127.0.0.1:<port>/callback`.
 * 3. Open the user's default browser at that URL.
 * 4. Admin UI authenticates the user (Kratos session), mints a scoped Hub
 *    Protocol API key via `trpc.apiKeys.connectIntegration`, and redirects
 *    to `http://127.0.0.1:<port>/callback?context={apiKey,podUrl,workspaceId}`.
 * 5. Local server receives the callback, extracts credentials, shuts down.
 *
 * This is the same flow Raycast uses (via a `raycast://` deeplink) — for CLI
 * we just swap the deeplink for a loopback HTTP URL. The admin UI's redirect
 * whitelist accepts both.
 *
 * Security notes:
 *   - Loopback only (127.0.0.1) — no external network can intercept.
 *   - One-shot: server only handles the first /callback, then exits.
 *   - 5-minute timeout.
 *   - No CSRF token: single-use, host-local, bound to the process.
 */
export interface BrowserAuthResult {
    apiKey: string;
    podUrl: string;
    workspaceId?: string;
}
export interface BrowserAuthOptions {
    podUrl: string;
    integration: "cli" | "raycast" | "openclaw" | "custom";
    /** Milliseconds to wait for the callback. Default 5min. */
    timeoutMs?: number;
    /** Hook invoked with the admin-panel URL right before opening the browser. */
    onUrlReady?: (url: string) => void;
}
export declare function runBrowserAuth(opts: BrowserAuthOptions): Promise<BrowserAuthResult>;