/**
 * AuthService
 *
 * Handles SSO authentication via the admin server.
 * Manages auth token storage in ~/.wave/auth.json.
 */
import type { AuthConfig, AuthUser } from "../types/auth.js";
export declare class AuthService {
    private static instance;
    private _serverUrl;
    private onAuthChangeCallbacks;
    private _refreshPromise;
    private _authFileMtime;
    private static readonly REFRESH_BUFFER_MS;
    static getInstance(): AuthService;
    /**
     * Set server URL programmatically (e.g. from AgentOptions.serverUrl).
     * Takes priority over WAVE_SERVER_URL environment variable.
     */
    setServerUrl(url: string): void;
    /**
     * Register a callback for auth state changes.
     * Returns an unsubscribe function.
     */
    onAuthChange(callback: (event: "login" | "logout") => void | Promise<void>): () => void;
    private notifyAuthChange;
    getAuthPath(): string;
    loadAuth(): AuthConfig;
    saveAuth(config: AuthConfig): void;
    clearAuth(): Promise<void>;
    getSSOToken(): string | undefined;
    getServerUrl(): string;
    login(options?: {
        /** Callback to receive the auth URL (for display in CLI). */
        onAuthUrl?: (url: string) => void;
        /** Read authorization code manually (e.g. from stdin). Resolves with code or rejects on cancel. */
        readToken?: () => Promise<string>;
        /** Server URL override. Falls back to setServerUrl() or WAVE_SERVER_URL env var. */
        serverUrl?: string;
    }): Promise<string>;
    /**
     * Exchange a short-lived authorization code for a JWT token.
     * Returns token, optional refresh token, optional expiresIn, and user info.
     */
    private exchangeCode;
    private startLocalAuthServer;
    isSSOAuthenticated(): boolean;
    /**
     * Check if the current token is expired or within the refresh buffer.
     * Returns false if no expiry info (backward compat — treated as never-expiring).
     */
    isTokenExpired(): boolean;
    /**
     * Check if the token needs refresh and refresh it if possible.
     * Deduplicates concurrent refresh calls (401 dedup).
     */
    checkAndRefreshTokenIfNeeded(): Promise<boolean>;
    /**
     * Refresh the access token using the stored refresh token.
     * Returns true on success, false on failure.
     */
    private refreshToken;
    /**
     * Check if another process has refreshed the token on disk.
     * Returns true if a fresh token was found and loaded.
     */
    /** @internal Check if another process has refreshed the token on disk */
    tryReadRefreshedTokenFromDisk(): boolean;
    getAuthUser(): AuthUser | undefined;
}
export declare const authService: AuthService;
/**
 * Create a fetch wrapper that handles SSO token refresh transparently.
 *
 * 1. Proactive refresh: calls checkAndRefreshTokenIfNeeded() before each request
 * 2. Updates Authorization header with fresh token
 * 3. Reactive 401/403 recovery: tries disk refresh then force refresh, retries once
 */
export declare function createAuthAwareFetch(innerFetch: typeof fetch): typeof fetch;
/**
 * Get or create a persistent anonymous ID for telemetry.
 *
 * Stored in ~/.wave/config.json as { anonymousId: "..." }.
 * Generated once on first run (32-byte random hex) and reused thereafter.
 * Falls back to an in-memory ID if file I/O fails.
 */
export declare function getOrCreateAnonymousId(): string;
/** @internal — reset anonymous ID cache for testing only */
export declare function __resetAnonymousIdForTesting(): void;