/** Optional env fallback for the OIDC issuer. No hardcoded default — the value
 *  comes from the target server's /api/capabilities, `--issuer`, or this var. */
export declare const DEFAULT_ISSUER: string;
export declare const DEFAULT_CLIENT_ID = "chat-recall-web";
export interface DeviceTokens {
    accessToken: string;
    refreshToken?: string;
    expiresIn: number;
}
export declare function deviceLogin(opts: {
    issuer?: string;
    clientId?: string;
    scope?: string;
}, onPrompt: (p: {
    url: string;
    userCode: string;
    verificationUri: string;
}) => void): Promise<DeviceTokens>;
/** Client id the CLI presents to the server's embedded provider. A public
 *  identifier (not a secret) — the server pins it via validateClient. */
export declare const BETTER_AUTH_CLI_CLIENT_ID = "chat-recall-cli";
/**
 * Device flow against the server's EMBEDDED better-auth provider
 * (AUTH_PROVIDER=better-auth): POST /api/auth/device/code, send the human to
 * the server's own /device page, poll /api/auth/device/token. Same RFC 8628
 * poll semantics as the Keycloak flavor; JSON bodies instead of form-encoded.
 */
export declare function betterAuthDeviceLogin(serverUrl: string, onPrompt: (p: {
    url: string;
    userCode: string;
    verificationUri: string;
}) => void): Promise<DeviceTokens>;
//# sourceMappingURL=device-auth.d.ts.map