/**
 * @license
 * Copyright 2025 Vybestack LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import type { TokenStore, ProviderKeyStorage, OAuthToken } from '@vybestack/llxprt-code-core';
import { RefreshCoordinator } from './refresh-coordinator.js';
/**
 * Interface for OAuth flow instances that can be used with the credential proxy.
 * @plan PLAN-20250217-CREDPROXY-REMEDIATION.P03
 */
export interface OAuthFlowInterface {
    initiateDeviceFlow(redirectUri?: string): Promise<{
        device_code: string;
        user_code?: string;
        verification_uri: string;
        verification_uri_complete?: string;
        expires_in: number;
        interval?: number;
    }>;
    exchangeCodeForToken?(code: string, state?: string): Promise<OAuthToken>;
    pollForToken?(deviceCode: string): Promise<OAuthToken>;
    refreshToken?(refreshToken: string): Promise<OAuthToken>;
}
export interface CredentialProxyServerOptions {
    tokenStore: TokenStore;
    providerKeyStorage: ProviderKeyStorage;
    socketDir?: string;
    /** Flow factories for OAuth initiation - maps provider name to factory function */
    flowFactories?: Map<string, () => OAuthFlowInterface>;
    /** OAuth session timeout in milliseconds (default 10 minutes) */
    oauthSessionTimeoutMs?: number;
    /** RefreshCoordinator for rate-limited, deduplicated token refresh */
    refreshCoordinator?: RefreshCoordinator;
}
export declare class CredentialProxyServer {
    private readonly options;
    private socketPath;
    private server;
    private readonly connections;
    private readonly refreshCoordinator;
    constructor(options: CredentialProxyServerOptions);
    start(): Promise<string>;
    stop(): Promise<void>;
    getSocketPath(): string | null;
    private buildSocketPath;
    private handleConnection;
    private isVersionCompatible;
    private handleHandshake;
    private dispatchRequest;
    private handleGetToken;
    private handleSaveToken;
    private handleRemoveToken;
    private handleListProviders;
    private handleListBuckets;
    private handleGetApiKey;
    private handleListApiKeys;
    private handleHasApiKey;
    private handleGetBucketStats;
    /**
     * OAuth session storage for managing active OAuth flows.
     * Sessions store the flow instance for later exchange/poll operations.
     * @plan PLAN-20250217-CREDPROXY-REMEDIATION.P03
     */
    private readonly oauthSessions;
    /**
     * Handles OAuth initiation - creates real flow instance and session.
     *
     * @plan PLAN-20250217-CREDPROXY-REMEDIATION.P03
     */
    private handleOAuthInitiate;
    /**
     * Detects the OAuth flow type for a given provider.
     *
     * @plan PLAN-20250217-CREDPROXY-REMEDIATION.P03
     */
    private detectFlowType;
    /**
     * Session timeout in milliseconds (default 10 minutes).
     * Can be overridden via options.oauthSessionTimeoutMs.
     */
    private static readonly SESSION_TIMEOUT_MS;
    /**
     * Handles OAuth code exchange - calls real provider, stores full token.
     *
     * CRITICAL: Token is stored in backingStore WITH refresh_token.
     *           Response is sanitized (refresh_token stripped).
     *
     * @plan PLAN-20250217-CREDPROXY-REMEDIATION.P05
     */
    private handleOAuthExchange;
    /**
     * Handle OAuth poll request for device_code flows.
     *
     * Polls the provider to check if the user has completed authorization.
     * Returns pending status until complete, then stores and returns the token.
     *
     * @plan PLAN-20250217-CREDPROXY-REMEDIATION.P04d
     */
    private handleOAuthPoll;
    private handleOAuthCancel;
    /**
     * Handles token refresh - uses RefreshCoordinator for rate limiting/dedup.
     *
     * CRITICAL: Token is stored in backingStore WITH refresh_token.
     *           Response is sanitized (refresh_token stripped).
     *           RefreshCoordinator handles rate limiting (30s) and deduplication.
     *
     * @plan PLAN-20250217-CREDPROXY-REMEDIATION.P07
     */
    private handleRefreshToken;
    private sendOk;
    private sendError;
}
