import type { AuthenticationGetSessionOptions, AuthenticationGetSessionPresentationOptions, AuthenticationSession } from 'vscode';
/**
 * A stricter version of {@link AuthenticationGetSessionPresentationOptions} that requires
 * a `detail` message explaining why authentication is needed. This forces callers to provide
 * meaningful context to the user instead of passing a bare `true` or `{}`.
 */
export type StrictAuthenticationPresentationOptions = AuthenticationGetSessionPresentationOptions & {
    detail: string;
};
import { Emitter, Event } from '../../../util/vs/base/common/event';
import { Disposable } from '../../../util/vs/base/common/lifecycle';
import { AuthProviderId, IConfigurationService } from '../../configuration/common/configurationService';
import { ILogService } from '../../log/common/logService';
import { CopilotToken } from './copilotToken';
import { ICopilotTokenManager } from './copilotTokenManager';
import { ICopilotTokenStore } from './copilotTokenStore';
export declare const GITHUB_SCOPE_USER_EMAIL: string[];
export declare const GITHUB_SCOPE_READ_USER: string[];
export declare const GITHUB_SCOPE_ALIGNED: string[];
export declare class MinimalModeError extends Error {
    constructor();
}
export declare const IAuthenticationService: import("../../../util/common/services").ServiceIdentifier<IAuthenticationService>;
export interface IAuthenticationService {
    readonly _serviceBrand: undefined;
    /**
     * Whether the authentication service is in minimal mode. If true, the authentication service will not attempt to
     * fetch the permissive token. This means that:
     * * {@link getGitHubSession} interactive flows with 'permissive' kind will always throw an error
     * * {@link getGitHubSession} silent flows with 'permissive' kind and {@link permissiveGitHubSession} will always return undefined
     */
    readonly isMinimalMode: boolean;
    /**
     * Event emitter that fires when the user's identity changes, e.g. when the user signs in, signs out,
     * or switches accounts. This does **not** fire on routine Copilot token refreshes (~every 20 minutes).
     *
     * Use {@link onDidCopilotTokenChange} if you need to react to Copilot token value changes (including refreshes).
     *
     * @note For best practice of handling of the user's authentication state, you should react to this event.
     */
    readonly onDidAuthenticationChange: Event<void>;
    /**
     * Event emitter that fires whenever the Copilot token changes, including routine refreshes
     * that occur approximately every 20 minutes. Use this if you need to react to changes in
     * token-embedded data such as quota information or feature flags.
     *
     * For identity changes (sign in/out, account switch), prefer {@link onDidAuthenticationChange}.
     */
    readonly onDidCopilotTokenChange: Event<void>;
    /**
     * @deprecated Use {@link onDidAuthenticationChange} instead. This event fires when the access token changes and not the copilot token.
     */
    readonly onDidAccessTokenChange: Event<void>;
    /**
     * Checks if there is currently any session available in the cache. Does not make any network requests and does not
     * call out to the underlying authentication provider.
     *
     * @note See {@link getAnyGitHubToken} for more information and for an async version by calling {@link getGitHubSession} with kind 'any' and `{ silent: true }`.
     * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
     * @note This token will have at least the `user:email` scope to be able to access the minimum Copilot API.
     */
    readonly anyGitHubSession: AuthenticationSession | undefined;
    /**
     * Whether the authentication service has a source from which a Copilot token can potentially be obtained
     * (e.g. a cached GitHub session, a static token provider, or a proxy/HMAC pathway). This is used as a fast,
     * synchronous gate before calling {@link getCopilotToken} in air-gapped/BYOK scenarios.
     *
     * Unlike {@link anyGitHubSession}, this does not assume GitHub OAuth is the only token pathway, so it stays
     * truthy for proxy/HMAC and test-harness implementations where {@link getCopilotToken} succeeds without a
     * cached GitHub session.
     */
    readonly hasCopilotTokenSource: boolean;
    /**
     * Checks if there is currently a permissive session available in the cache. Does not make any network requests and does not
     * call out to the underlying authentication provider.
     *
     * @note See {@link getPermissiveGitHubToken} for more information and for an async version by calling {@link getGitHubSession} with kind 'permissive' and `{ silent: true }`.
     * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
     * @returns undefined if no auth session is available or Minimal Mode is enabled. Otherwise, returns an auth session with the `repo` scope.
     */
    readonly permissiveGitHubSession: AuthenticationSession | undefined;
    /**
     * Gets a GitHub session capable of calling GitHub APIs.
     * @param kind - The kind of session that you need. **Your choice here should be thoughtful.**
     * - 'permissive': You need a session that can access the user's private repositories or needs write access.
     * - 'any': You only need a session that can access public information about the user.
     * @param options - Options for getting the session.
     * @returns Promise<AuthenticationSession> - The requested authentication session.
     * @throws MinimalModeError - If kind is 'permissive' and the authentication service is in minimal mode.
     * @throws Error - If no session is acquired (user cancels).
     */
    getGitHubSession(kind: 'permissive' | 'any', options: AuthenticationGetSessionOptions & {
        createIfNone: StrictAuthenticationPresentationOptions;
    }): Promise<AuthenticationSession>;
    /**
     * Gets a GitHub session capable of calling GitHub APIs.
     * @param kind - The kind of session that you need. **Your choice here should be thoughtful.**
     * - 'permissive': You need a session that can access the user's private repositories or needs write access.
     * - 'any': You only need a session that can access public information about the user.
     * @param options - Options for getting the session.
     * @returns Promise<AuthenticationSession> - The requested authentication session.
     * @throws MinimalModeError - If kind is 'permissive' and the authentication service is in minimal mode.
     * @throws Error - If no session is acquired (user cancels).
     */
    getGitHubSession(kind: 'permissive' | 'any', options: AuthenticationGetSessionOptions & {
        forceNewSession: StrictAuthenticationPresentationOptions;
    }): Promise<AuthenticationSession>;
    /**
     * Gets a GitHub session capable of calling GitHub APIs.
     * @param kind - The kind of session that you need. **Your choice here should be thoughtful.**
     * - 'permissive': You need a session that can access the user's private repositories or needs write access.
     * - 'any': You only need a session that can access public information about the user.
     * @param options - Options for getting the session.
     * @returns Promise<AuthenticationSession> - The requested authentication session. OR
     * @returns Promise<undefined> - If no session is available or kind is 'permissive' and the authentication service is in minimal mode.
     * @see {@link isMinimalMode} for more information about minimal mode.
     */
    getGitHubSession(kind: 'permissive' | 'any', options: Omit<AuthenticationGetSessionOptions, 'createIfNone' | 'forceNewSession'>): Promise<AuthenticationSession | undefined>;
    /**
     * Checks if there is currently a Copilot token available in the cache. Does not make any network requests.
     * See {@link getCopilotToken} for more information and for an async version.
     *
     * @note we omit token here because it is possibly expired. If you need it, use {@link getCopilotToken} instead as it includes a refresh mechanism.
     * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
     */
    readonly copilotToken: Omit<CopilotToken, 'token'> | undefined;
    /**
     * Return the token needed to authenticate with the speculative decoding endpoint.
     * This token is public as it is set via a request to the ChatMLFetcher and reset either via expiration or a 403 response from the SD endpoint.
     * @note There is no guarantee this is a valid token and it can still reject due to 403 with the SD endpoint
     */
    speculativeDecodingEndpointToken: string | undefined;
    /**
     * Return a currently valid Copilot token, retrieving a fresh one if
     * necessary.
     *
     * @param force will force a refresh of the token, even if not expired
     * @returns a Copilot token or throws an error if none is found.
     * @note For best practice of handling of the user's authentication state, you should react to {@link onDidAuthenticationChange}.
     */
    getCopilotToken(force?: boolean): Promise<CopilotToken>;
    /**
     * Drop the current Copilot token as we received an HTTP error while trying
     * to use it that indicates it's no longer valid.
     */
    resetCopilotToken(httpError?: number): void;
    /**
     * Fired when the authentication state changes for ado.
     */
    readonly onDidAdoAuthenticationChange: Event<void>;
    /**
     * Returns a valid Azure DevOps session for the user
     */
    getAdoAccessTokenBase64(options?: AuthenticationGetSessionOptions): Promise<string | undefined>;
}
export declare abstract class BaseAuthenticationService extends Disposable implements IAuthenticationService {
    protected readonly _logService: ILogService;
    protected readonly _tokenStore: ICopilotTokenStore;
    private readonly _tokenManager;
    protected readonly _configurationService: IConfigurationService;
    readonly _serviceBrand: undefined;
    private readonly _onDidAuthenticationChange;
    readonly onDidAuthenticationChange: Event<void>;
    private readonly _onDidCopilotTokenChange;
    readonly onDidCopilotTokenChange: Event<void>;
    protected fireAuthenticationChange(source: string): void;
    protected fireCopilotTokenChange(source: string): void;
    protected readonly _onDidAccessTokenChange: Emitter<void>;
    readonly onDidAccessTokenChange: Event<void>;
    protected readonly _onDidAdoAuthenticationChange: Emitter<void>;
    readonly onDidAdoAuthenticationChange: Event<void>;
    constructor(_logService: ILogService, _tokenStore: ICopilotTokenStore, _tokenManager: ICopilotTokenManager, _configurationService: IConfigurationService);
    protected _isMinimalMode: import("../../../util/vs/base/common/observableInternal").IObservableWithChange<boolean, void>;
    get isMinimalMode(): boolean;
    protected _anyGitHubSession: AuthenticationSession | undefined;
    get anyGitHubSession(): AuthenticationSession | undefined;
    get hasCopilotTokenSource(): boolean;
    protected _permissiveGitHubSession: AuthenticationSession | undefined;
    get permissiveGitHubSession(): AuthenticationSession | undefined;
    abstract getGitHubSession(kind: 'permissive' | 'any', options: AuthenticationGetSessionOptions & {
        createIfNone: StrictAuthenticationPresentationOptions;
    }): Promise<AuthenticationSession>;
    abstract getGitHubSession(kind: 'permissive' | 'any', options: AuthenticationGetSessionOptions & {
        forceNewSession: StrictAuthenticationPresentationOptions;
    }): Promise<AuthenticationSession>;
    abstract getGitHubSession(kind: 'permissive' | 'any', options: Omit<AuthenticationGetSessionOptions, 'createIfNone' | 'forceNewSession'>): Promise<AuthenticationSession | undefined>;
    protected _anyAdoSession: AuthenticationSession | undefined;
    get anyAdoSession(): AuthenticationSession | undefined;
    protected abstract getAnyAdoSession(options?: AuthenticationGetSessionOptions): Promise<AuthenticationSession | undefined>;
    private _copilotTokenError;
    get copilotToken(): CopilotToken | undefined;
    getCopilotToken(force?: boolean): Promise<CopilotToken>;
    resetCopilotToken(httpError?: number): void;
    speculativeDecodingEndpointToken: string | undefined;
    abstract getAdoAccessTokenBase64(options?: AuthenticationGetSessionOptions): Promise<string | undefined>;
    protected _handleAuthChangeEvent(): Promise<void>;
}
export declare function authProviderId(configurationService: IConfigurationService): AuthProviderId;
//# sourceMappingURL=authentication.d.ts.map