/**
 * Credential resolution — shared between TUI, agent, and CI modes.
 *
 * Reads stored OAuth tokens, refreshes them if needed, fetches the user's
 * org/project/environment list, and populates session credentials when
 * possible. When multiple environments exist, populates `pendingOrgs` so
 * the caller (TUI AuthScreen or AgentUI NDJSON prompt) can handle selection.
 */
import type { WizardSession } from './wizard-session';
/**
 * Resolve credentials from stored OAuth tokens and environment data.
 *
 * Mutates `session` in place:
 * - Sets `session.credentials` when a single environment or local key is found
 * - Sets `session.pendingOrgs` + `pendingAuthIdToken` + `pendingAuthAccessToken`
 *   when multiple environments exist (caller must handle selection)
 * - Sets `session.apiKeyNotice` when auto-fetch fails
 *
 * Skips entirely when `session.apiKey` is already set (--api-key flag) or
 * `session.credentials` is already populated.
 */
export declare function resolveCredentials(session: WizardSession, options?: {
    /**
     * When true, clears credentials if no org/project ID is set.
     * TUI mode uses this so AuthScreen can force selection.
     * Agent/CI mode should set false — a local API key is sufficient.
     */
    requireOrgId?: boolean;
    /** Org name filter (from --org flag). Case-insensitive partial match. */
    org?: string;
    /** Environment name filter (from --env flag). Case-insensitive match. */
    env?: string;
    /**
     * Project ID filter (from --project-id flag). Matches project.id
     * exactly. Lets agents disambiguate when multiple projects have
     * environments with the same name. (The backend GraphQL layer still
     * calls this a "workspace" — we expose it as `projectId` to match
     * the rest of the wizard.)
     */
    projectId?: string;
    /**
     * Numeric Amplitude app ID filter (from --app-id flag; --project-id is
     * a legacy alias). Matches environment.app.id exactly. Globally unique
     * — one app ID maps to exactly one (org, project, env) triple.
     */
    appId?: string;
    /**
     * Optional OAuth access token (from AMPLITUDE_TOKEN env var).
     * When provided and a stored session exists, replaces the stored
     * access token. Does NOT bypass the stored idToken/refreshToken —
     * a prior login is still required for agent mode to fetch project
     * API keys.
     */
    accessTokenOverride?: string;
}): Promise<void>;
/**
 * Resolve environment selection from pendingOrgs.
 *
 * Given a selected org ID, project ID, and environment name,
 * populates session.credentials from the matching environment.
 * Returns true if credentials were populated.
 */
export declare function resolveEnvironmentSelection(session: WizardSession, selection: {
    orgId: string;
    projectId: string;
    env: string;
}): Promise<boolean>;
