/**
 * `ruflo auth login` flow orchestration (ADR-306) — composes
 * `@claude-flow/security`'s ported OAuth primitives (loopback PKCE, OOB
 * manual-paste, refresh) the same way meta-proxy's `oauth/login.rs`
 * orchestrates its own Rust primitives. See security-bridge.ts for why the
 * package is loaded lazily, and oauth/client.ts (in @claude-flow/security)
 * for why this targets the live `auth.cognitum.one` surface rather than
 * ADR-308's unconfirmed `/v1/auth/*` spec.
 *
 * @module auth/client
 */
import { type OAuthTokenResponse } from './security-bridge.js';
/** Refresh before there is less than one minute left on the access token. */
export declare const ACCESS_TOKEN_REFRESH_WINDOW_MS = 60000;
export interface LoginResult {
    tokens: OAuthTokenResponse;
    method: 'pkce' | 'device' | 'token-stdin';
}
/**
 * Best-effort headlessness signal — a false negative just means the browser
 * flow is attempted and a real browser opens fine anyway; a false positive
 * means the user falls back to the manual OOB flow, which always works
 * regardless. Mirrors meta-proxy's `login.rs::is_probably_headless()`.
 */
export declare function isProbablyHeadless(): boolean;
/**
 * Validates the OAuth callback params against the request that started the
 * flow — the CSRF-critical step, extracted so it's independently testable.
 * Order matters: an explicit `error` (user denied) and a missing code are
 * reported as their own reasons; a missing or mismatched `state` is always
 * a state-mismatch, even when a code is present.
 */
export declare function validateCallback(error: string | null, code: string | null, returnedState: string | null, expectedState: string): {
    ok: true;
    code: string;
} | {
    ok: false;
    reason: 'denied' | 'state-mismatch';
    detail?: string;
};
export declare class LoginCancelledError extends Error {
    constructor();
}
export declare class LoginDeniedError extends Error {
    constructor(detail: string);
}
export declare class StateMismatchError extends Error {
    constructor();
}
export declare class NotLoggedInError extends Error {
    constructor(profile: string);
}
export declare class SessionOnlyExpiredError extends Error {
    constructor(profile: string);
}
export declare class ScopeConsentMismatchError extends Error {
    constructor(profile: string, scopes: string[]);
}
/** Browser-based loopback PKCE login — the ADR-306 default for an interactive desktop. */
export declare function browserLogin(print: (line: string) => void): Promise<LoginResult>;
/** Headless fallback: prints the authorize URL with the OOB redirect, prompts for the pasted code. */
export declare function manualLogin(print: (line: string) => void, input?: NodeJS.ReadableStream): Promise<LoginResult>;
/**
 * `--token-stdin`: reads one JSON object from stdin,
 * `{access_token, refresh_token?, expires_in, scope}`. Wire format is not
 * specified by ADR-306 — defined here as typed JSON rather than a bare
 * token string, so scope/expiry are explicit rather than inferred.
 */
export declare function tokenStdinLogin(input?: NodeJS.ReadableStream): Promise<LoginResult>;
/**
 * Refreshes an access token. Classifies failure into network-unreachable
 * vs. a reachable-but-erroring server so callers can print an honest
 * message instead of collapsing both into "offline" (ADR-308 failure
 * policy: local ruflo functionality is never affected by auth being
 * unavailable, but the diagnostic should say WHY it's unavailable).
 */
export declare function refreshAccessToken(refreshTokenValue: string): Promise<OAuthTokenResponse>;
/**
 * Returns an access token suitable for an authenticated call.
 *
 * Fast path: a process-memory token with more than one minute remaining.
 * Slow path: load the profile's refresh token from the OS keychain, perform
 * one refresh, persist a rotated refresh token BEFORE exposing the new access
 * token, then update metadata and the process cache. Refresh is deliberately
 * demand-driven: offline-safe commands such as plain `auth status` never call
 * this function and therefore never create background traffic or retry loops.
 */
export declare function getValidAccessToken(profileName?: string): Promise<string>;
//# sourceMappingURL=client.d.ts.map