import { type AuthBackend, type Identity } from "./authBackend.js";
export interface PkceLoginOptions {
    /** Console origin that serves /cli-auth (browser target). */
    consoleUrl: string;
    /** Backend API base URL the PAT authenticates against. */
    apiUrl: string;
    /** Abort if the browser round-trip doesn't complete in time. Default 5 min. */
    timeoutMs?: number;
    /** Backend calls (exchange + me). Default: real HTTP against apiUrl. */
    backend?: AuthBackend;
    /** Pick a free loopback port. Default: the OS ephemeral picker. */
    pickPort?: () => Promise<number>;
    /** Launch the browser. Default: spawn the platform opener. Tests pass a capturing fake. */
    openBrowser?: (url: string) => void;
    /** Persist the PAT. Default: write ~/.vincentt/config.json. */
    saveToken?: (apiUrl: string, pat: string) => Promise<string>;
    /** Emit an in-progress line (the "→ Opening…" / fallback / "Waiting…" narration). */
    onProgress?: (line: string) => void;
}
export interface PkceLoginResult {
    identity: Identity;
    configPath: string;
}
/** Thrown when the wait elapses with no approval; drives the L4 timeout transcript. */
export declare class LoginTimeoutError extends Error {
    constructor();
}
/** Thrown when the loopback callback fails state-verify or is cancelled (QA-F1-C3). */
export declare class LoginCallbackError extends Error {
    constructor(message: string);
}
/** The platform command + args to open `url` in the default browser. */
export declare function browserOpenCommand(url: string, platform?: string): {
    cmd: string;
    args: string[];
};
type SpawnLike = (cmd: string, args: string[], opts: {
    stdio: "ignore";
    detached: boolean;
}) => {
    on: (e: "error", cb: () => void) => void;
    unref: () => void;
};
/** Launch the browser via an injected spawn; a throw is swallowed (fallback = the printed URL). */
export declare function launchBrowser(url: string, spawn: SpawnLike, platform?: string): void;
/**
 * Run the loopback + PKCE exchange, persist the PAT, and confirm identity via /me.
 * Resolves with the confirmed identity + the config path; rejects with LoginTimeoutError
 * or LoginCallbackError. NO token is written on any failure (the write only happens after
 * a successful exchange).
 */
export declare function runPkceLogin(opts: PkceLoginOptions): Promise<PkceLoginResult>;
export {};