import { type Brand } from '../im/lark/lark-hosts.js';
export interface TokenStore {
    access_token: string;
    refresh_token: string;
    token_type: string;
    expires_at: string;
    refresh_expires_at: string;
    scope: string;
    /**
     * token 所属应用 / 品牌。旧的单文件没有这两个字段（undefined）——按"属于升级前
     * 唯一的那个 feishu bot"兼容处理（见 {@link loadTokenForApp}）。
     */
    appId?: string;
    brand?: Brand;
}
/**
 * Resolve a valid User Access Token.
 * Returns access_token string, or null if unavailable.
 */
export declare function resolveUserToken(appId: string, appSecret: string, brand?: Brand): Promise<string | null>;
/**
 * 飞书文档订阅入口（/subscribe-lark-doc）专用的额外 OAuth scope。**不进**全局
 * DEFAULT_SCOPES —— 否则所有 bot 的通用 /login（图片下载用）都会请求这些 scope，
 * 没在开发者后台启用它们的 app 会一起 20043 失败。改由 /subscribe-lark-doc 在
 * 需要时通过 generateAuthUrl 的 extraScopes 单独带上。
 *
 * 每个 scope 都对着 src/setup/lark-scopes.json 校验过（错名会触发 authorize 报
 * 错 20043）。使用前仍需在开发者后台为该 app 启用这些 scope 并订阅评论事件。
 */
export declare const DOC_COMMENT_OAUTH_SCOPES: string[];
/**
 * 会话群标签（p2pMode=group + feedGroup）专用的额外 OAuth scope。飞书「消息分组」
 * 是用户个人侧边栏数据，只认 user_access_token —— 与 DOC_COMMENT_OAUTH_SCOPES
 * 同理**不进**通用 /login 的 DEFAULT_SCOPES。使用前需在开发者后台为该 app 启用
 * 这两个用户 scope（见 setup/lark-scopes.json）。
 */
export declare const FEED_GROUP_OAUTH_SCOPES: string[];
/**
 * Resolve the OAuth redirect_uri. With global-config `oauthRedirectBase` set
 * (typically the host's dashboard origin), auth flows redirect to the
 * dashboard's `/oauth/callback` receiver and complete automatically; without
 * it, the legacy localhost paste-back address is used. The chosen URI must be
 * registered in the app's console redirect-URL whitelist either way.
 */
export declare function resolveOAuthRedirectUri(): string;
/**
 * Generate an OAuth authorization URL. Returns the URL and stores pending state.
 * Called by /login command handler.
 */
export declare function generateAuthUrl(appId: string, appSecret: string, brand?: Brand, extraScopes?: string[]): {
    authUrl: string;
    state: string;
};
/** Structured callback outcome for programmatic receivers (dashboard IPC).
 *  `matched=false` means the state belongs to another daemon process — the
 *  caller should try the next one rather than reporting failure. */
export interface CallbackHandleResult {
    matched: boolean;
    ok: boolean;
    message: string;
}
/**
 * Structured variant of handleCallbackUrl. Returns null when the URL is not a
 * callback at all; `{matched:false}` when the state is not pending in THIS
 * process (another daemon may own it).
 */
export declare function tryHandleCallbackUrl(url: string): Promise<CallbackHandleResult | null>;
/**
 * Feed-group authorization status for the dashboard's session-group tag UI:
 * authorized = a stored token for this app carries the feed-group write scope
 * and is still usable (valid or refreshable).
 */
export declare function getFeedGroupAuthStatus(appId: string, brand?: Brand): {
    authorized: boolean;
    expiresAt?: string;
};
/**
 * Try to parse a callback URL and exchange the code for a token.
 * Returns a success message or null if the URL is not a valid callback.
 */
export declare function handleCallbackUrl(url: string): Promise<string | null>;
/**
 * Check if a message looks like an OAuth callback URL.
 */
export declare function isCallbackUrl(text: string): boolean;
/**
 * Get current token status for /login status display. Per-app: reports the
 * token belonging to this bot (appId/brand), not whatever was last written.
 */
export declare function getTokenStatus(appId: string, brand?: Brand): string;
//# sourceMappingURL=user-token.d.ts.map