import { randomBytes } from 'node:crypto';
import { type AgentLoginConfig } from './config.js';
import type { AgentCredentials, CredentialStore } from './credential-store.js';
import { type AgentSubjectDisplay, type AgentSubjectDisplayStatus, type AgentSubjectDisplayView } from './subject-display.js';
type AuthorizationResponse = {
    authorizationId: string;
    authorizationUrl: string;
    expiresIn: number;
};
type TokenResponse = AgentSubjectDisplayView & {
    accessToken: string;
    refreshToken: string;
    expiresIn: number;
    refreshExpiresIn: number;
    sessionId: string;
    clientAppId: string;
};
export type AgentSessionView = {
    session_id: string;
    client_app_id: string;
    device_label: string;
    principal: Record<string, unknown>;
    on_behalf_of: string;
    allowed_routes: string[];
    created_at: string;
    expires_at: string;
    refresh_expires_at: string;
    subject_display: AgentSubjectDisplay | null;
    subject_display_status: AgentSubjectDisplayStatus;
};
export interface AgentAccessTokenProvider {
    getAccessToken(forceRefresh?: boolean): Promise<string>;
}
export type LoopbackCallback = {
    code: string;
    state: string;
};
export type LoopbackCallbackReceiver = {
    redirectUri: string;
    waitForCallback(timeoutMilliseconds: number): Promise<LoopbackCallback>;
    close(): Promise<void>;
};
type LoginDependencies = {
    store: CredentialStore;
    fetchImpl?: typeof fetch;
    createLoopbackReceiver?: (expectedState: string) => Promise<LoopbackCallbackReceiver>;
    openBrowser?: (url: string) => Promise<void>;
    randomBytesImpl?: typeof randomBytes;
    now?: () => number;
    /** Runs only after credentials are safely stored; optional display work cannot invalidate login. */
    onSessionValidated?: (session: AgentSessionView) => Promise<void>;
};
type LogoutResult = {
    hadCredentials: boolean;
    remoteRevoked: boolean;
};
export declare class AgentAuthHttpClient {
    private readonly baseUrl;
    private readonly fetchImpl;
    constructor(baseUrl: string, fetchImpl?: typeof fetch);
    createAuthorization(input: {
        clientAppId: string;
        redirectUri: string;
        state: string;
        codeChallenge: string;
        route: string;
        deviceLabel: string;
    }): Promise<AuthorizationResponse>;
    exchangeCode(input: {
        clientAppId: string;
        code: string;
        redirectUri: string;
        codeVerifier: string;
    }): Promise<TokenResponse>;
    refresh(clientAppId: string, refreshToken: string): Promise<TokenResponse>;
    getSession(accessToken: string): Promise<AgentSessionView>;
    revoke(input: {
        clientAppId: string;
        refreshToken: string;
        accessToken?: string;
    }): Promise<void>;
    private request;
}
export declare function createLoopbackCallbackReceiver(expectedState: string): Promise<LoopbackCallbackReceiver>;
export declare function systemBrowserCommand(url: string, platform?: NodeJS.Platform): {
    executable: string;
    args: string[];
};
export declare function openSystemBrowser(url: string): Promise<void>;
export declare function performAgentLogin(config: AgentLoginConfig, dependencies: LoginDependencies): Promise<AgentCredentials>;
export declare class AgentSessionManager implements AgentAccessTokenProvider {
    private readonly store;
    private readonly fetchImpl;
    private readonly now;
    private refreshInFlight;
    constructor(store: CredentialStore, fetchImpl?: typeof fetch, now?: () => number);
    loadRequired(): Promise<AgentCredentials>;
    getAccessToken(forceRefresh?: boolean): Promise<string>;
    getSession(): Promise<AgentSessionView>;
    logout(): Promise<LogoutResult>;
    private refresh;
    private performRefresh;
    private deleteInvalidCredentials;
    private deleteInvalidCredentialsIfCurrent;
}
export {};
//# sourceMappingURL=agent-auth.d.ts.map