/**
 * @license
 * Copyright 2025 Vybestack LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import { OAuthToken, AuthStatus, TokenStore } from './types.js';
import { LoadedSettings } from '../config/settings.js';
import { MessageBus, Config } from '@vybestack/llxprt-code-core';
/**
 * @plan PLAN-20251020-STATELESSPROVIDER3.P12
 * @requirement REQ-SP3-003
 * @pseudocode oauth-safety.md lines 1-17
 */
export declare function unwrapLoggingProvider<T extends OAuthProvider | undefined>(provider: T): T;
/**
 * Interface for OAuth provider abstraction
 * Each provider (e.g., Google, Qwen) implements this interface
 */
export interface OAuthProvider {
    /** Provider name (e.g., 'gemini', 'qwen') */
    name: string;
    /**
     * Initiate OAuth authentication flow
     * This starts the device flow or opens browser for auth
     */
    initiateAuth(): Promise<void>;
    /**
     * Get current OAuth token for this provider
     * @returns OAuth token if available, null otherwise
     */
    getToken(): Promise<OAuthToken | null>;
    /**
     * Refresh token if it's expired or about to expire
     * @returns Refreshed token or null if refresh failed
     */
    refreshIfNeeded(): Promise<OAuthToken | null>;
}
/**
 * OAuth Manager coordinates multiple OAuth providers
 * Provides unified interface for authentication across providers
 */
export declare class OAuthManager {
    private providers;
    private tokenStore;
    private settings?;
    private inMemoryOAuthState;
    private sessionBuckets;
    private bucketResolutionLocks;
    private getMessageBus?;
    private getConfig?;
    constructor(tokenStore: TokenStore, settings?: LoadedSettings);
    private withBucketResolutionLock;
    /**
     * Set the message bus getter for interactive TUI prompts
     * Uses a getter function to enable lazy resolution after TUI is initialized
     * @param getter - Function that returns the message bus instance from Config
     */
    setMessageBus(getter: () => MessageBus | undefined): void;
    /**
     * Set the config getter for bucket failover handler setup
     * Uses a getter function to enable lazy resolution
     * @plan PLAN-20251213issue490
     * @param getter - Function that returns the Config instance
     */
    setConfigGetter(getter: () => Config | undefined): void;
    /**
     * Register an OAuth provider with the manager
     * @param provider - The OAuth provider to register
     */
    registerProvider(provider: OAuthProvider): void;
    /**
     * Get a registered OAuth provider
     * @param name - Provider name
     * @returns OAuth provider or undefined if not registered
     */
    getProvider(name: string): OAuthProvider | undefined;
    /**
     * Authenticate with a specific provider
     * @param providerName - Name of the provider to authenticate with
     * @param bucket - Optional bucket name for multi-account support
     */
    authenticate(providerName: string, bucket?: string): Promise<void>;
    /**
     * Get authentication status for all registered providers
     * @returns Array of authentication status for each provider
     */
    getAuthStatus(): Promise<AuthStatus[]>;
    /**
     * @plan PLAN-20250823-AUTHFIXES.P14
     * @requirement REQ-002
     * @pseudocode lines 51-68
     * Check if authenticated with a specific provider (required by precedence resolver)
     * @param providerName - Name of the provider
     * @param bucket - Optional bucket name
     * @returns True if authenticated, false otherwise
     */
    isAuthenticated(providerName: string, bucket?: string): Promise<boolean>;
    /**
     * @plan PLAN-20250823-AUTHFIXES.P14
     * @requirement REQ-002.1
     * @pseudocode lines 4-37
     * Logout from a specific provider by clearing stored tokens
     * @param providerName - Name of the provider to logout from
     * @param bucket - Optional bucket name for multi-account support
     */
    logout(providerName: string, bucket?: string): Promise<void>;
    /**
     * @plan PLAN-20250823-AUTHFIXES.P14
     * @requirement REQ-002
     * @pseudocode lines 39-49
     * Logout from all providers by clearing all stored tokens
     */
    logoutAll(): Promise<void>;
    /**
     * Get OAuth token for a specific provider
     * Compatible with precedence resolver - returns access token string
     * @param providerName - Name of the provider
     * @param _metadata - Optional metadata for token request (unused in CLI implementation)
     * @returns Access token string if available, null otherwise
     */
    getToken(providerName: string, bucket?: string | unknown): Promise<string | null>;
    /**
     * Retrieve the stored OAuth token without refreshing it.
     * Returns null if the provider is unknown or no token exists.
     */
    peekStoredToken(providerName: string): Promise<OAuthToken | null>;
    /**
     * Get OAuth token object for a specific provider
     * @param providerName - Name of the provider
     * @param bucket - Optional bucket name for multi-account support (if string), or metadata (for backward compatibility)
     * @returns OAuth token if available, null otherwise
     */
    getOAuthToken(providerName: string, bucket?: string | unknown): Promise<OAuthToken | null>;
    /**
     * Get list of all registered provider names
     * @returns Array of provider names
     */
    getSupportedProviders(): string[];
    /**
     * Toggle OAuth enablement for a provider
     * @param providerName - Name of the provider
     * @returns New enablement state (true if enabled, false if disabled)
     */
    toggleOAuthEnabled(providerName: string): Promise<boolean>;
    /**
     * Check if OAuth is enabled for a provider
     * @param providerName - Name of the provider
     * @returns True if OAuth is enabled, false otherwise
     */
    isOAuthEnabled(providerName: string): boolean;
    private setOAuthEnabledState;
    getTokenStore(): TokenStore;
    /**
     * Check for higher priority authentication methods
     * @param providerName - Name of the provider to check
     * @returns String describing higher priority auth method, null if none
     */
    getHigherPriorityAuth(providerName: string): Promise<string | null>;
    /**
     * Check if a URL is compatible with Qwen OAuth
     * @param url - The base URL to check
     * @returns True if compatible, false otherwise
     */
    private isQwenCompatibleUrl;
    /**
     * CRITICAL FIX: Clear all auth caches for a provider after logout
     * This method finds and clears auth caches from both BaseProvider and provider-specific implementations
     * @param providerName - Name of the provider to clear caches for
     *
     * @plan PLAN-20251020-STATELESSPROVIDER3.P12
     * @requirement REQ-SP3-003
     * @pseudocode oauth-safety.md lines 1-17
     */
    private clearProviderAuthCaches;
    /**
     * Set session bucket override for a provider
     * Session state is in-memory only and not persisted
     */
    setSessionBucket(provider: string, bucket: string): void;
    /**
     * Get session bucket override for a provider
     * Returns undefined if no session override set
     */
    getSessionBucket(provider: string): string | undefined;
    /**
     * Clear session bucket override for a provider
     */
    clearSessionBucket(provider: string): void;
    /**
     * List all buckets for a provider
     */
    listBuckets(provider: string): Promise<string[]>;
    /**
     * Logout from all buckets for a provider
     */
    logoutAllBuckets(provider: string): Promise<void>;
    /**
     * Get authentication status with bucket information
     */
    getAuthStatusWithBuckets(provider: string): Promise<Array<{
        bucket: string;
        authenticated: boolean;
        expiry?: number;
        isSessionBucket: boolean;
    }>>;
    /**
     * Get the list of buckets for the current profile for a given provider
     * If the current profile has auth.buckets configured, return those.
     * Otherwise, return empty array (single-bucket or non-OAuth profile)
     */
    private getProfileBuckets;
    /**
     * Authenticate multiple OAuth buckets sequentially using MultiBucketAuthenticator
     * with timing controls (delay/prompt) and browser auto-open settings
     */
    private authenticateMultipleBuckets;
}
