/**
 * Amplitude OAuth2/PKCE flow — adapted from Amplitude wizard's oauth.ts but
 * hitting Amplitude's auth endpoints (same as the ampli CLI).
 *
 * Key difference from a bare OAuth client: checks the wizard session store
 * for an existing session first (migrates legacy `~/.ampli.json` on read),
 * so returning users skip re-authenticating when tokens are still valid.
 */
import * as http from 'node:http';
import { z } from 'zod';
import { type AmplitudeZone } from '../lib/constants.js';
declare const OAuthTokenResponseSchema: z.ZodObject<{
    access_token: z.ZodString;
    id_token: z.ZodString;
    refresh_token: z.ZodString;
    token_type: z.ZodString;
    expires_in: z.ZodNumber;
}, z.core.$strip>;
export type OAuthTokenResponse = z.infer<typeof OAuthTokenResponseSchema>;
/**
 * Error thrown when no port in the OAUTH_PORT range is available. Callers
 * surface `userMessage` instead of the raw error.
 */
export declare class OAuthPortInUseError extends Error {
    readonly userMessage: string;
    readonly basePort: number;
    constructor(basePort: number);
}
/**
 * Maximum number of consecutive ports to try after OAUTH_PORT on EADDRINUSE.
 *
 * The Amplitude OAuth app only accepts redirect URIs whose port is in this
 * allowlisted range, which is why we don't use port 0 (OS-assigned).
 * Concurrent wizard runs each pick the next free port in the range.
 */
export declare const OAUTH_PORT_RETRY_LIMIT = 10;
export declare function startCallbackServer(): Promise<{
    server: http.Server;
    port: number;
    waitForCallback: (expectedState: string) => Promise<string>;
}>;
/** Exported for tests only. */
export declare const __testing: {
    /** Bind to a single concrete port — exposed so tests can simulate EADDRINUSE
     *  without going through the OAUTH_PORT-anchored retry loop. */
    tryStartCallbackServer: (port: number) => Promise<{
        server: http.Server;
        port: number;
        waitForCallback: (expectedState: string) => Promise<string>;
    }>;
    /** Run the retry loop. */
    startCallbackServer: () => Promise<{
        server: http.Server;
        port: number;
        waitForCallback: (expectedState: string) => Promise<string>;
    }>;
    closeServer: (server: http.Server) => Promise<void>;
};
export interface AmplitudeAuthResult {
    idToken: string;
    accessToken: string;
    refreshToken: string;
    zone: AmplitudeZone;
}
/**
 * Performs the Amplitude OAuth2/PKCE flow.
 *
 * 1. Checks the wizard OAuth session file for a valid existing session,
 *    unless forceFresh is true (used for new projects with no local binding).
 * 2. If none, opens the browser to auth.amplitude.com and awaits callback.
 * 3. Stores the resulting tokens in the wizard session store.
 */
export declare function performAmplitudeAuth(options: {
    zone?: AmplitudeZone;
    /** Skip cached credentials and require fresh browser auth. */
    forceFresh?: boolean;
    /**
     * Optional abort signal — when triggered, closes the local callback server
     * and rejects the auth promise with an AbortError. Lets SIGINT/cleanup
     * paths reclaim the OAuth port without waiting for the 2-minute timeout.
     */
    signal?: AbortSignal;
}): Promise<AmplitudeAuthResult>;
/**
 * Exchanges a stored refresh token for a new access token.
 * Uses the same /oauth2/token endpoint as the initial auth-code exchange.
 */
export declare function refreshAccessToken(refreshToken: string, zone?: AmplitudeZone): Promise<{
    accessToken: string;
    idToken: string;
    refreshToken: string;
    expiresAt: string;
}>;
export type OAuthConfig = {
    scopes: string[];
    signup?: boolean;
};
/** @deprecated Use performAmplitudeAuth() directly. */
export declare function performOAuthFlow(_config: OAuthConfig): Promise<OAuthTokenResponse>;
export {};
