/**
 * Reddit authentication manager
 */
export interface AuthConfig {
    clientId: string;
    clientSecret: string;
    username?: string;
    password?: string;
    accessToken?: string;
    refreshToken?: string;
    expiresAt?: number;
    scope?: string;
    userAgent?: string;
}
export declare class AuthManager {
    private config;
    private configPath;
    private configFromEnv;
    private tokenRefreshPromise;
    private readonly TOKEN_EXPIRATION_BUFFER_MS;
    constructor();
    /**
     * Load authentication configuration
     */
    load(): Promise<AuthConfig | null>;
    /**
     * Load configuration from environment variables
     */
    private loadFromEnv;
    /**
     * Clean environment variable value
     * Handles empty strings, undefined, and unresolved template strings
     */
    private cleanEnvVar;
    /**
     * Check if a string contains unresolved template patterns
     */
    private containsUnresolvedTemplate;
    /**
     * Save authentication configuration
     */
    save(config: AuthConfig): Promise<void>;
    /**
     * Get current configuration
     */
    getConfig(): AuthConfig | null;
    /**
     * Check if authenticated
     */
    isAuthenticated(): boolean;
    /**
     * Check if token is expired or will expire soon (including buffer for clock drift)
     * Returns true if:
     * - No expiresAt set
     * - Current time >= expiresAt
     * - Current time >= expiresAt - buffer (to handle clock drift and refresh early)
     */
    isTokenExpired(): boolean;
    /**
     * Get access token for Reddit OAuth
     */
    getAccessToken(): Promise<string | null>;
    /**
     * Refresh access token using client credentials
     * Uses a lock to prevent concurrent refresh attempts (race conditions)
     */
    refreshAccessToken(): Promise<void>;
    /**
     * Internal implementation of token refresh (protected by lock)
     */
    private doRefreshAccessToken;
    /**
     * Clear authentication
     */
    clear(): Promise<void>;
    /**
     * Get headers for Reddit API requests
     */
    getHeaders(): Promise<Record<string, string>>;
    /**
     * Get rate limit based on auth status
     */
    getRateLimit(): number;
    /**
     * Get cache TTL based on auth status (in ms)
     */
    getCacheTTL(): number;
    /**
     * Check if we have full authentication (with user credentials)
     */
    hasFullAuth(): boolean;
    /**
     * Get auth mode string for display
     */
    getAuthMode(): string;
    /**
     * Private: Get configuration directory path based on OS
     */
    private getConfigPath;
    /**
     * Private: Validate configuration
     */
    private isValidConfig;
    /**
     * Setup wizard for authentication
     */
    static runSetupWizard(): Promise<AuthConfig>;
}
//# sourceMappingURL=auth.d.ts.map