/**
 * Credential storage for API keys and OAuth tokens.
 * Handles loading, saving, and refreshing credentials from auth.json.
 *
 * Uses file locking to prevent race conditions when multiple pi instances
 * try to refresh tokens simultaneously.
 */
import { type CredentialStore, type ModelAuth, type OAuthCredentials } from "@earendil-works/pi-ai";
import { type AuthStorageBackend } from "./auth-storage-backends.ts";
import { type AtomicOAuthLoginCallbacks } from "./oauth-provider-bridge.ts";
export type ApiKeyCredential = {
    type: "api_key";
    key: string;
};
export type OAuthCredential = {
    type: "oauth";
} & OAuthCredentials;
export type AuthCredential = ApiKeyCredential | OAuthCredential;
export type AuthStorageData = Record<string, AuthCredential>;
export type AuthStatus = {
    configured: boolean;
    source?: "stored" | "runtime" | "environment" | "fallback" | "models_json_key" | "models_json_command";
    label?: string;
};
export { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from "./auth-storage-backends.ts";
/**
 * Credential storage backed by a JSON file.
 */
export declare class AuthStorage {
    private data;
    private runtimeOverrides;
    private fallbackResolver?;
    private loadError;
    private errors;
    private credentialMutationTail;
    private credentialVersions;
    private storage;
    private constructor();
    static create(authPath?: string | string[]): AuthStorage;
    static fromStorage(storage: AuthStorageBackend): AuthStorage;
    static inMemory(data?: AuthStorageData): AuthStorage;
    /**
     * Set a runtime API key override (not persisted to disk).
     * Used for CLI --api-key flag.
     */
    setRuntimeApiKey(provider: string, apiKey: string): void;
    /** Read a non-persisted request override without resolving stored credentials. */
    getRuntimeApiKey(provider: string): string | undefined;
    /**
     * Remove a runtime API key override.
     */
    removeRuntimeApiKey(provider: string): void;
    /**
     * Set a fallback resolver for API keys not found in auth.json or env vars.
     * Used for custom provider keys from models.json.
     */
    setFallbackResolver(resolver: (provider: string) => string | undefined): void;
    private recordError;
    private parseStorageData;
    /**
     * Reload credentials from storage.
     */
    reload(): void;
    /**
     * Read the credential snapshot, preferring the backend's lock-free `read()`.
     * Falls back to a `withLock`-based read for custom backends that predate
     * `read()` so the released `AuthStorageBackend` interface stays compatible.
     */
    private readSnapshot;
    private bumpCredentialVersion;
    private persistProviderChange;
    /**
     * Get credential for a provider.
     */
    get(provider: string): AuthCredential | undefined;
    /**
     * Set credential for a provider.
     */
    set(provider: string, credential: AuthCredential): void;
    /**
     * Remove credential for a provider.
     */
    remove(provider: string): void;
    /**
     * List all providers with credentials.
     */
    list(): string[];
    /**
     * Check if credentials exist for a provider in auth.json.
     */
    has(provider: string): boolean;
    /**
     * Check if any form of auth is configured for a provider.
     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
     */
    hasAuth(provider: string): boolean;
    /**
     * Return auth status without exposing credential values or refreshing tokens.
     */
    getAuthStatus(provider: string): AuthStatus;
    /** Return a copy of all persisted credentials. */
    getAll(): AuthStorageData;
    drainErrors(): Error[];
    /**
     * Returns the error from the most recent failed credential load, or null when
     * the last reload succeeded.
     *
     * A non-null value means stored credentials could NOT be read — e.g. the auth
     * file was temporarily locked by another process (ELOCKED) or contained
     * invalid JSON — so an empty/absent credential set is NOT authoritative.
     * Callers that would otherwise report "No API key found" should surface this
     * load failure instead of treating the provider as unauthenticated
     * (issue #1431).
     */
    getLoadError(): Error | null;
    /**
     * Login to an OAuth provider.
     */
    login(providerId: string, callbacks: AtomicOAuthLoginCallbacks): Promise<void>;
    /** Logout through the preserved synchronous persistence path. */
    logout(provider: string): void;
    /** Serialized logout for callers that need persistence completion. */
    logoutAsync(provider: string): Promise<void>;
    /**
     * Refresh OAuth token with backend locking to prevent race conditions.
     * Multiple pi instances may try to refresh simultaneously when tokens expire.
     */
    private refreshOAuthTokenWithLock;
    /**
     * Get API key for a provider.
     * Priority:
     * 1. Runtime override (CLI --api-key)
     * 2. API key from auth.json
     * 3. OAuth token from auth.json (auto-refreshed with locking)
     * 4. Environment variable
     * 5. Fallback resolver (models.json custom providers)
     */
    getModelAuth(providerId: string, options?: {
        includeFallback?: boolean;
    }): Promise<ModelAuth | undefined>;
    getApiKey(providerId: string, options?: {
        includeFallback?: boolean;
    }): Promise<string | undefined>;
    /**
     * Get all registered OAuth providers
     */
    getOAuthProviders(): import("./oauth-provider-bridge.ts").OAuthProviderDescriptor[];
    private runCredentialMutation;
    /** Private async adapter for pi-ai's provider-owned Models runtime. */
    asCredentialStore(): CredentialStore;
}
//# sourceMappingURL=auth-storage.d.ts.map