/**
 * Token file operations and path management
 */
import type { CLIProxyProvider } from '../types';
import { AccountInfo } from './types';
/**
 * Get path to accounts registry file
 */
export declare function getAccountsRegistryPath(): string;
export interface RecoverableTokenFile {
    tokenFile: string;
    filePath: string;
    paused: boolean;
}
interface ListRecoverableTokenFilesOptions {
    includePaused?: boolean;
}
/**
 * Get path to paused tokens directory
 * Paused tokens are moved here so CLIProxyAPI won't discover them
 *
 * Uses sibling directory (auth-paused/) instead of subdirectory (auth/paused/)
 * because CLIProxyAPI's watcher uses filepath.Walk() which recursively scans
 * all subdirectories of auth/. A sibling directory is completely outside
 * CLIProxyAPI's scan path, preventing token refresh loops.
 */
export declare function getPausedDir(): string;
/**
 * List token files that can be used to rebuild the accounts registry.
 * Active auth tokens win over paused duplicates with the same filename.
 */
export declare function listRecoverableTokenFiles(options?: ListRecoverableTokenFilesOptions): RecoverableTokenFile[];
/**
 * Get token file path for an account
 * Returns path in paused/ dir if account is paused, otherwise auth/
 */
export declare function getAccountTokenPath(account: AccountInfo): string;
/**
 * Move token file to paused directory
 * Creates paused directory if needed, idempotent
 */
export declare function moveTokenToPaused(tokenFile: string): boolean;
/**
 * Move token file from paused directory back to auth
 * Idempotent
 */
export declare function moveTokenFromPaused(tokenFile: string): boolean;
/**
 * Delete token file from both auth and paused directories
 * Idempotent
 */
export declare function deleteTokenFile(tokenFile: string): boolean;
/**
 * Check if token file exists in either auth or paused directory
 */
export declare function tokenFileExists(tokenFile: string): boolean;
/**
 * Extract unique account ID from token filename when email is unavailable
 * For Kiro/GHCP OAuth, filenames are: <provider>-<oauth>-<profile_id>.json
 * Extracts: <oauth>-<profile_id> as unique identifier
 * @example kiro-github-ABC123.json → github-ABC123
 * @example ghcp-amazon-XYZ789.json → amazon-XYZ789
 * @example kiro-nomail.json → default (no OAuth structure)
 */
export declare function extractAccountIdFromTokenFile(filename: string, email?: string): string;
/**
 * Derive a collision-safe internal account ID for providers that may not expose email.
 * Reuses the existing entry when the token file is already known, otherwise prefers the
 * filename-derived ID before falling back to provider-scoped sequential IDs.
 */
export declare function deriveNoEmailProviderAccountId(provider: CLIProxyProvider, tokenFile: string, existingAccounts: Record<string, Pick<AccountInfo, 'tokenFile' | 'nickname'>>): string;
/**
 * Generate nickname from email
 * Takes prefix before @ symbol, sanitizes whitespace
 * Validation: 1-50 chars, any non-whitespace (permissive per user preference)
 */
export declare function generateNickname(email?: string): string;
/**
 * Validate nickname
 * Rules: 1-50 chars, no whitespace, URL-safe, no reserved patterns
 * @returns null if valid, error message if invalid
 */
export declare function validateNickname(nickname: string): string | null;
/**
 * Check whether a nickname would collide with any existing account ID or nickname.
 */
export declare function hasAccountNameConflict(accounts: Array<Pick<AccountInfo, 'id' | 'nickname'>>, candidateName: string, excludeAccountId?: string): boolean;
/**
 * Find the existing account that already owns the supplied id/nickname.
 */
export declare function findAccountNameMatch(accounts: Array<Pick<AccountInfo, 'id' | 'nickname'>>, candidateName: string): Pick<AccountInfo, 'id' | 'nickname'> | null;
export {};
//# sourceMappingURL=token-file-ops.d.ts.map