/**
 * Auth Types and Configurations
 *
 * Type definitions and OAuth configurations for CLIProxy authentication.
 */
import { CLIProxyProvider } from '../types';
import type { AccountInfo } from '../accounts/account-manager';
/**
 * Kiro authentication methods supported by CLIProxyAPIPlus.
 * - aws: AWS Builder ID via Device Code flow
 * - aws-authcode: AWS Builder ID via Authorization Code flow (CLI flag only)
 * - google: Social OAuth via Google
 * - github: Social OAuth via GitHub (management API only)
 * - idc: IAM Identity Center (IDC) via CLI flags with start URL + region
 */
export declare const KIRO_AUTH_METHODS: readonly ["aws", "aws-authcode", "google", "github", "idc"];
export type KiroAuthMethod = (typeof KIRO_AUTH_METHODS)[number];
/** CLI binary supports these Kiro methods directly via flags. */
export declare const KIRO_CLI_AUTH_METHODS: readonly ["aws", "aws-authcode", "google", "idc"];
export type KiroCLIAuthMethod = (typeof KIRO_CLI_AUTH_METHODS)[number];
export declare const KIRO_IDC_FLOWS: readonly ["authcode", "device"];
export type KiroIDCFlow = (typeof KIRO_IDC_FLOWS)[number];
export declare const DEFAULT_KIRO_IDC_FLOW: KiroIDCFlow;
/** Default Kiro method for CCS UX and AWS Organization support. */
export declare const DEFAULT_KIRO_AUTH_METHOD: KiroAuthMethod;
export declare function isKiroAuthMethod(value: string): value is KiroAuthMethod;
export declare function isKiroCLIAuthMethod(value: string): value is KiroCLIAuthMethod;
export declare function isKiroIDCFlow(value: string): value is KiroIDCFlow;
export declare function normalizeKiroAuthMethod(value?: string): KiroAuthMethod;
export declare function normalizeKiroIDCFlow(value?: string): KiroIDCFlow;
export declare function isKiroDeviceCodeMethod(method: KiroAuthMethod, options?: {
    idcFlow?: KiroIDCFlow;
}): boolean;
export declare function getKiroCallbackPort(method: KiroAuthMethod, options?: {
    idcFlow?: KiroIDCFlow;
}): number | null;
export declare function getKiroCLIAuthFlag(method: KiroCLIAuthMethod): string;
export declare function getKiroCLIAuthArgs(method: KiroCLIAuthMethod, options?: {
    idcStartUrl?: string;
    idcRegion?: string;
    idcFlow?: KiroIDCFlow;
}): string[];
/**
 * Kiro method for CLIProxyAPI management endpoint:
 * GET /v0/management/kiro-auth-url?method=<value>
 */
export declare function toKiroManagementMethod(method: KiroAuthMethod): 'aws' | 'google' | 'github' | null;
/**
 * OAuth callback ports used by CLIProxyAPI (hardcoded in binary)
 * See: https://github.com/router-for-me/CLIProxyAPI/tree/main/internal/auth
 *
 * OAuth flow types per provider:
 * - Gemini: Authorization Code Flow with local callback server on port 8085
 * - Codex:  Authorization Code Flow with local callback server on port 1455
 * - Agy:    Authorization Code Flow with local callback server on port 51121
 * - iFlow:  Authorization Code Flow with local callback server on port 11451
 * - Claude: Authorization Code Flow with local callback server on port 54545 (Anthropic OAuth)
 * - Kiro:   Device Code Flow (polling-based, NO callback port needed)
 * - Qwen:   Device Code Flow (polling-based, NO callback port needed)
 * - GHCP:   Device Code Flow (polling-based, NO callback port needed)
 * - Kimi:   Device Code Flow (polling-based, NO callback port needed)
 * - Cursor: Device-style browser polling (NO callback port needed)
 * - GitLab: Authorization Code Flow with callback server on port 17171
 * - CodeBuddy: Device-style browser polling (NO callback port needed)
 * - Kilo: Device Code Flow (polling-based, NO callback port needed)
 */
export declare const OAUTH_CALLBACK_PORTS: Partial<Record<CLIProxyProvider, number>>;
/**
 * Auth status for a provider
 */
export interface AuthStatus {
    /** Provider name */
    provider: CLIProxyProvider;
    /** Whether authentication exists */
    authenticated: boolean;
    /** Path to token directory */
    tokenDir: string;
    /** Token file paths found */
    tokenFiles: string[];
    /** When last authenticated (if known) */
    lastAuth?: Date;
    /** Accounts registered for this provider (multi-account support) */
    accounts: AccountInfo[];
    /** Default account ID */
    defaultAccount?: string;
}
/**
 * OAuth config for each provider
 */
export interface ProviderOAuthConfig {
    /** Provider identifier */
    provider: CLIProxyProvider;
    /** Display name */
    displayName: string;
    /** OAuth authorization URL (for manual flow) */
    authUrl: string;
    /** Scopes required */
    scopes: string[];
    /** CLI flag for auth */
    authFlag: string;
}
/**
 * OAuth configurations per provider
 * Note: CLIProxyAPI handles actual OAuth - these are for display/manual flow
 */
export declare const OAUTH_CONFIGS: Record<CLIProxyProvider, ProviderOAuthConfig>;
/**
 * Provider-specific auth file prefixes (fallback detection)
 * CLIProxyAPI names auth files with provider prefix (e.g., "antigravity-user@email.json")
 * Note: Gemini tokens may NOT have prefix - CLIProxyAPI uses {email}-{projectID}.json format
 */
export declare const PROVIDER_AUTH_PREFIXES: Record<CLIProxyProvider, string[]>;
/**
 * Provider type values inside token JSON files
 * CLIProxyAPI sets "type" field in token JSON (e.g., {"type": "gemini"})
 */
export declare const PROVIDER_TYPE_VALUES: Record<CLIProxyProvider, string[]>;
/**
 * Maps CCS provider names to CLIProxyAPI callback provider names
 * Used when submitting OAuth callbacks to CLIProxyAPI management endpoint
 */
export declare const CLIPROXY_CALLBACK_PROVIDER_MAP: Record<CLIProxyProvider, string>;
/**
 * Maps CCS provider names to CLIProxyAPI auth-url endpoint prefixes.
 * Used for GET /v0/management/${prefix}-auth-url endpoints.
 * These differ from callback names for some providers (e.g., gemini-cli vs gemini).
 */
export declare const CLIPROXY_AUTH_URL_PROVIDER_MAP: Record<CLIProxyProvider, string>;
export declare function getManagementAuthUrlPath(provider: CLIProxyProvider): string;
export declare function getPasteCallbackStartPath(provider: CLIProxyProvider, options?: {
    kiroMethod?: KiroAuthMethod;
}): string | null;
export declare function getManagementOAuthCallbackPath(): string;
/**
 * Get OAuth config for provider
 */
export declare function getOAuthConfig(provider: CLIProxyProvider): ProviderOAuthConfig;
/**
 * OAuth options for triggerOAuth
 */
export interface OAuthOptions {
    verbose?: boolean;
    headless?: boolean;
    account?: string;
    add?: boolean;
    nickname?: string;
    /** If true, caller explicitly accepts Antigravity OAuth risk for this command/session. */
    acceptAgyRisk?: boolean;
    /** Kiro auth method override (CLI + Dashboard parity). */
    kiroMethod?: KiroAuthMethod;
    /** Kiro IDC start URL (required when kiroMethod=idc). */
    kiroIDCStartUrl?: string;
    /** Kiro IDC region override. */
    kiroIDCRegion?: string;
    /** Kiro IDC flow override (authcode or device). */
    kiroIDCFlow?: KiroIDCFlow;
    /** If true, triggered from Web UI (enables project selection prompt) */
    fromUI?: boolean;
    /** If true, use --no-incognito flag (Kiro only - use normal browser instead of incognito) */
    noIncognito?: boolean;
    /** If true, skip OAuth and import token from Kiro IDE directly (Kiro only) */
    import?: boolean;
    /** GitLab auth mode override. */
    gitlabAuthMode?: 'oauth' | 'pat';
    /** GitLab self-hosted base URL override. */
    gitlabBaseUrl?: string;
    /** GitLab personal access token for PAT login. */
    gitlabPersonalAccessToken?: string;
    /** Enable paste-callback mode: show auth URL and prompt for callback paste */
    pasteCallback?: boolean;
    /** If true, use port-forwarding mode (skip interactive prompt in headless) */
    portForward?: boolean;
}
//# sourceMappingURL=auth-types.d.ts.map