/**
 * Google OAuth authentication for CLI
 *
 * Implements the localhost HTTP server callback pattern for Google SSO.
 * Opens the user's browser to Google's consent screen, captures the
 * authorization code via redirect to localhost, and exchanges it for tokens.
 */
import * as http from "http";
/**
 * Google OAuth client credentials (Desktop app type).
 * For Desktop app type, the client secret is not truly secret -- this is
 * standard practice (same as firebase-tools, gcloud CLI, etc.).
 * Used for the localhost callback flow.
 */
export declare const GOOGLE_OAUTH_CLIENT_ID = "199991289749-otcibgl0kp53qq2tn46n08iutm62pq6h.apps.googleusercontent.com";
export declare const GOOGLE_OAUTH_CLIENT_SECRET = "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";
/**
 * Google OAuth Web Application client ID (for headless/no-localhost flow).
 * The client secret is kept server-side on noriskillsets.dev.
 * Used when --no-localhost flag is specified.
 */
export declare const GOOGLE_OAUTH_WEB_CLIENT_ID = "199991289749-qneu4fa6jn6q5ss256ogj6ldg90b0h6a.apps.googleusercontent.com";
/**
 * Validate that OAuth credentials have been configured for localhost flow.
 * Throws if still using placeholder values.
 *
 * @throws Error if credentials are still placeholders
 */
export declare const validateOAuthCredentials: () => void;
/**
 * Validate that Web OAuth client ID has been configured for headless flow.
 * Throws if still using placeholder value.
 *
 * @throws Error if web client ID is still a placeholder
 */
export declare const validateWebOAuthCredentials: () => void;
/** Default warning delay before timeout (ms) */
export declare const AUTH_WARNING_MS: number;
/**
 * Result from the Google OAuth token exchange
 */
export type GoogleTokenResult = {
    idToken: string;
    accessToken: string;
};
/**
 * Find an available port starting from startPort
 *
 * @param args - Configuration arguments
 * @param args.startPort - Port to start checking from
 * @param args.maxAttempts - Maximum number of ports to try
 *
 * @throws Error if no port is available
 *
 * @returns An available port number
 */
export declare const findAvailablePort: (args: {
    startPort?: number | null;
    maxAttempts?: number | null;
}) => Promise<number>;
/**
 * Build the Google OAuth authorization URL
 *
 * @param args - Configuration arguments
 * @param args.clientId - Google OAuth client ID
 * @param args.redirectUri - Redirect URI (http://localhost:{port})
 * @param args.state - CSRF protection nonce
 *
 * @returns The full Google OAuth authorization URL
 */
export declare const getGoogleAuthUrl: (args: {
    clientId: string;
    redirectUri: string;
    state: string;
}) => string;
/**
 * Start a temporary HTTP server to capture the OAuth callback
 *
 * @param args - Configuration arguments
 * @param args.port - Port to listen on
 * @param args.expectedState - Expected state parameter for CSRF validation
 * @param args.timeoutMs - Timeout in milliseconds
 * @param args.warningMs - Time before timeout to call onTimeoutWarning (optional)
 * @param args.onTimeoutWarning - Callback to invoke when warning threshold reached (optional)
 *
 * @throws Error on timeout, user cancellation, or CSRF mismatch
 *
 * @returns Promise resolving with the authorization code and server reference
 */
export declare const startAuthServer: (args: {
    port: number;
    expectedState: string;
    timeoutMs?: number | null;
    warningMs?: number | null;
    onTimeoutWarning?: (() => void) | null;
}) => Promise<{
    code: string;
    server: http.Server;
}>;
/**
 * Exchange an authorization code for Google tokens
 *
 * @param args - Configuration arguments
 * @param args.code - Authorization code from OAuth callback
 * @param args.clientId - Google OAuth client ID
 * @param args.clientSecret - Google OAuth client secret
 * @param args.redirectUri - Redirect URI used in the auth request
 *
 * @throws Error if token exchange fails
 *
 * @returns Google tokens including id_token
 */
export declare const exchangeCodeForTokens: (args: {
    code: string;
    clientId: string;
    clientSecret: string;
    redirectUri: string;
}) => Promise<GoogleTokenResult>;
/**
 * Generate a cryptographic nonce for CSRF protection
 *
 * @returns A random hex string
 */
export declare const generateState: () => string;
/**
 * Detect if running in a headless or SSH environment
 *
 * Checks for common SSH environment variables that indicate the session
 * is running over SSH, where a local browser cannot be opened.
 *
 * @returns true if running in an SSH or headless environment
 */
export declare const isHeadlessEnvironment: () => boolean;
//# sourceMappingURL=googleAuth.d.ts.map