/**
 * Better Auth device authorization (RFC 8628) client for Vigilbase One.
 *
 * Server plugin: https://better-auth.com/docs/plugins/device-authorization
 * Endpoints (relative to One's Better Auth base, typically `/api/auth`):
 *   POST /device/code
 *   POST /device/token
 *
 * Public tool commands do not use this module. One-scoped commands will.
 */
import type { CliConfig } from '../lib/config.js';
import type { DeviceCodeResponse, DeviceTokenPendingError, DeviceTokenSuccess } from './types.js';
export declare class DeviceAuthError extends Error {
    readonly code?: string;
    readonly status: number;
    readonly body: unknown;
    /** The message is the CLI's own text, never the server's (see VigilbaseApiError). */
    readonly isCliAuthored: boolean;
    constructor(message: string, options: {
        status: number;
        code?: string;
        body?: unknown;
        isCliAuthored?: boolean;
    });
}
export declare function requestDeviceCode(config: CliConfig, options?: {
    scope?: string;
}): Promise<DeviceCodeResponse>;
export type PollResult = {
    status: 'authorized';
    token: DeviceTokenSuccess;
} | {
    status: 'pending';
    error: DeviceTokenPendingError;
} | {
    status: 'denied';
    error: DeviceTokenPendingError;
} | {
    status: 'expired';
    error: DeviceTokenPendingError;
} | {
    status: 'transient';
    httpStatus: number;
    error: DeviceTokenPendingError;
};
export declare function pollDeviceToken(config: CliConfig, deviceCode: string): Promise<PollResult>;
export declare function sleep(ms: number, signal?: AbortSignal): Promise<void>;
/**
 * Run the full device-code poll loop until authorized, denied, or expired.
 * Returns the token payload on success.
 */
export declare function waitForDeviceAuthorization(config: CliConfig, device: DeviceCodeResponse, options?: {
    onPending?: (info: {
        attempt: number;
        intervalSec: number;
        kind: 'pending' | 'transient';
    }) => void;
    signal?: AbortSignal;
    maxConsecutiveTransient?: number;
}): Promise<DeviceTokenSuccess>;