/**
 * Shared, IO-free primitives for the headless OAuth login engine.
 *
 * These were previously duplicated inside the CLI's `auth-menu/*-oauth.ts`
 * terminal flows. They live here so BOTH the CLI and the two WebUI servers
 * can drive a subscription sign-in without depending on terminal IO or a
 * particular config-persistence layer.
 *
 * Nothing here opens a browser or writes config — the caller (CLI renderer
 * or WebSocket handler) decides how to surface the authorize URL and how to
 * persist the resulting {@link import('./index.js').OAuthLoginOutcome}.
 */
export declare function base64url(buf: Buffer): string;
export interface Pkce {
    verifier: string;
    challenge: string;
}
/** Generate a PKCE verifier + S256 challenge. */
export declare function generatePkce(): Pkce;
/** Random CSRF state, URL-safe like the upstream Codex OAuth flow. */
export declare function createState(): string;
/**
 * Parse a pasted authorization code or full redirect URL into `{ code, state }`.
 * Handles three shapes: a full `http://localhost:PORT/...?code=&state=` URL, a
 * bare `code#state` (Anthropic's hash convention), a `code=...&state=...` query
 * fragment, or a bare code.
 */
export declare function parseAuthorizationInput(input: string): {
    code?: string | undefined;
    state?: string | undefined;
};
export declare function callbackHtml(ok: boolean, message: string): string;
export interface LoopbackServer {
    /** Resolves with `{ code, state }`, or null if cancelled / failed to bind. */
    waitForCode(): Promise<{
        code: string;
        state: string;
    } | null>;
    close(): void;
    /** True when the server bound to a callback port; false means all ports were busy. */
    readonly bound: boolean;
    /** Actual callback port selected by the listener. */
    readonly port: number;
}
export interface LoopbackOptions {
    port: number;
    fallbackPorts?: number[] | undefined;
    host: string;
    /** Expected callback path, e.g. `/auth/callback` or `/callback`. */
    path: string;
    /** Expected OAuth `state` — a mismatch aborts the wait (CSRF guard). */
    expectedState: string;
    /** Abort (e.g. user cancel) → unblock the pending wait and tear down. */
    signal?: AbortSignal | undefined;
}
/**
 * Start a one-shot loopback HTTP server that captures the OAuth redirect.
 * Resolves once listening (or once it fails to bind — in which case `bound`
 * is false and the caller falls back to manual paste).
 */
export declare function startLoopbackServer(opts: LoopbackOptions): Promise<LoopbackServer>;
//# sourceMappingURL=shared.d.ts.map