/**
 * Device login flow and API key management. The device endpoints work
 * anonymously; the API key management endpoints require an account JWT
 * (API keys cannot manage API keys).
 */
import type { Client } from './client.js';
import type { Body, Res } from './types.js';
/** POST /auth/device/start — Start a device login. Anonymous allowed. */
export declare const deviceStart: (client: Client) => Promise<{
    device_code: string;
    expires_in: number;
    interval: number;
    user_code: string;
    verification_uri: string;
    verification_uri_complete: string;
}>;
/** POST /auth/device/poll — Poll a device login. Anonymous allowed. */
export declare const devicePoll: (client: Client, deviceCode: string) => Promise<{
    approved: boolean;
}>;
/** POST /auth/device/complete — Complete a device login. Anonymous allowed. */
export declare const deviceComplete: (client: Client, deviceCode: string, confirmationCode: string) => Promise<{
    access_token: string;
    refresh_token: string;
    user: {
        created_at: string;
        email: string;
        id: string;
    };
}>;
/** GET /auth/api-keys — List API keys (account JWT only). */
export declare const listApiKeys: (client: Client) => Promise<{
    "api-keys": {
        created_at: string;
        id: string;
        key_prefix: string;
        last_used_at: string | null;
        name: string;
        revoked_at: string | null;
        revoked_reason: string | null;
        status: "active" | "revoked";
    }[];
}>;
/** POST /auth/api-keys — Create an API key (account JWT only). */
export declare const createApiKey: (client: Client, body: Body<"/auth/api-keys", "post">) => Promise<{
    "api-key": {
        created_at: string;
        id: string;
        key_prefix: string;
        last_used_at: string | null;
        name: string;
        revoked_at: string | null;
        revoked_reason: string | null;
        status: "active" | "revoked";
    };
    token: string;
}>;
/** POST /auth/api-keys/{id}/revoke — Revoke an API key (account JWT only). */
export declare const revokeApiKey: (client: Client, id: string) => Promise<{
    ok: boolean;
}>;
export type DeviceStart = Res<'/auth/device/start', 'post'>;
export type DeviceLoginOptions = Readonly<{
    /** Called with the start response so a person can approve in a browser; default prints instructions. */
    onPrompt?: (start: DeviceStart) => void | Promise<void>;
    /** Returns the confirmation code shown after approval; default reads a line from stdin. */
    confirm?: (start: DeviceStart) => string | Promise<string>;
    /** Poll interval; defaults to the server-suggested `interval` (seconds). */
    intervalMs?: number;
    /** Overall deadline; defaults to the server's `expires_in`. */
    timeoutMs?: number;
}>;
/**
 * Run the whole device login flow: start, prompt, poll until approved,
 * complete. Returns the completion body; feed its `access_token` to
 * `createClient` as `apiKey`. Throws a timeout error when the login is not
 * approved in time.
 */
export declare const deviceLogin: (client: Client, options?: DeviceLoginOptions) => Promise<{
    access_token: string;
    refresh_token: string;
    user: {
        created_at: string;
        email: string;
        id: string;
    };
}>;