/**
 * OAuth Handler for CLIProxyAPI
 *
 * Manages OAuth authentication flow for CLIProxy providers (Gemini, Codex, Antigravity, Kiro, Copilot).
 * CLIProxyAPI handles OAuth internally - we just need to:
 * 1. Check if auth exists (token files in CCS auth directory)
 * 2. Trigger OAuth flow by spawning binary with auth flag
 * 3. Auto-detect headless environments (SSH, no DISPLAY)
 * 4. Use --no-browser flag for headless, display OAuth URL for manual auth
 * 5. Handle Device Code flows for Copilot/Qwen (no callback server)
 */
/// <reference types="node" />
/// <reference types="bun-types" />
import { CLIProxyBackend, CLIProxyProvider } from '../types';
import { AccountInfo } from '../accounts/account-manager';
import { OAuthOptions, ProviderOAuthConfig } from './auth-types';
import { ProviderTokenSnapshot } from './token-manager';
import { type ProxyTarget } from '../proxy/proxy-target-resolver';
import { type OAuthTraceRecorder } from './oauth-trace';
interface PasteCallbackStartData {
    url?: string;
    auth_url?: string;
    state?: string;
    status?: string;
}
interface PasteCallbackTraceOptions {
    trace?: OAuthTraceRecorder;
    promptForCallbackUrl?: (timeoutMs: number) => Promise<string | null>;
    timeoutMs?: number;
    pollIntervalMs?: number;
}
/**
 * Table of providers that require Google OAuth client credentials when running
 * against CLIProxy Plus. Keyed by CLIProxyProvider value.
 *
 * Used by the generalized helpers so the dashboard handler can guard any
 * table-listed provider without duplicating env-var names.
 */
export declare const PLUS_OAUTH_ENV_BY_PROVIDER: Partial<Record<CLIProxyProvider, {
    idEnv: string;
    secretEnv: string;
    displayName: string;
}>>;
/**
 * Generalized credential-missing guard for any provider in PLUS_OAUTH_ENV_BY_PROVIDER.
 *
 * Returns null when:
 *   - provider is not in the table (not a Plus-credentialed provider)
 *   - backend is not 'plus'
 *   - both credential env vars are set and non-empty
 *
 * Returns an error string when Plus is active and one or both vars are missing.
 */
export declare function getPlusOAuthCredentialError(provider: CLIProxyProvider, backend: CLIProxyBackend, env?: NodeJS.ProcessEnv): string | null;
/**
 * Generalized auth-URL guard for any provider in PLUS_OAUTH_ENV_BY_PROVIDER.
 *
 * Returns null when:
 *   - provider is not in the table
 *   - authUrl cannot be parsed as a URL (ignore malformed upstream responses)
 *   - client_id query param is present and non-empty
 *
 * Returns an error string when client_id is absent or empty.
 */
export declare function getPlusAuthUrlCredentialError(provider: CLIProxyProvider, authUrl: string): string | null;
export declare function getGeminiPlusOAuthCredentialError(provider: CLIProxyProvider, backend: CLIProxyBackend, env?: NodeJS.ProcessEnv): string | null;
export declare function getGeminiAuthUrlCredentialError(provider: CLIProxyProvider, authUrl: string): string | null;
export declare function requestPasteCallbackStart(provider: CLIProxyProvider, target: ProxyTarget, options?: {
    kiroMethod?: OAuthOptions['kiroMethod'];
    gitlabBaseUrl?: OAuthOptions['gitlabBaseUrl'];
}): Promise<PasteCallbackStartData>;
export declare function getCliAuthNicknameError(provider: CLIProxyProvider, nickname: string | undefined, existingAccounts: Array<Pick<AccountInfo, 'id' | 'nickname'>>, allowExistingAccountId?: string): string | null;
export declare function normalizeGitLabBaseUrl(baseUrl: string | undefined): string | undefined;
export declare function promptGitLabPersonalAccessToken(): Promise<string | null>;
export declare function findNewTokenSnapshotForManualAuth(provider: CLIProxyProvider, tokenDir: string, knownTokenFiles: ProviderTokenSnapshot[], expectedAccountId?: string): ProviderTokenSnapshot | null;
export declare function resolvePasteCallbackAuthUrl(target: ProxyTarget, startData: PasteCallbackStartData, timeoutMs: number, pollIntervalMs?: number): Promise<string | null>;
export declare function usesKiroLocalCallbackReplay(method: OAuthOptions['kiroMethod'], idcFlow: OAuthOptions['kiroIDCFlow']): boolean;
export declare function handlePasteCallbackMode(provider: CLIProxyProvider, oauthConfig: ProviderOAuthConfig, verbose: boolean, tokenDir: string, nickname?: string, expectedAccountId?: string, options?: {
    kiroMethod?: OAuthOptions['kiroMethod'];
    gitlabBaseUrl?: OAuthOptions['gitlabBaseUrl'];
    add?: boolean;
} & PasteCallbackTraceOptions): Promise<AccountInfo | null>;
/**
 * Trigger OAuth flow for provider
 * Auto-detects headless environment and uses --no-browser flag accordingly
 * Shows real-time step-by-step progress for better user feedback
 * Handles both Authorization Code (callback server) and Device Code (polling) flows
 */
export declare function triggerOAuth(provider: CLIProxyProvider, options?: OAuthOptions): Promise<AccountInfo | null>;
/**
 * Ensure provider is authenticated
 * Triggers OAuth flow if not authenticated
 */
export declare function ensureAuth(provider: CLIProxyProvider, options?: {
    verbose?: boolean;
    headless?: boolean;
    account?: string;
}): Promise<boolean>;
export {};
//# sourceMappingURL=oauth-handler.d.ts.map