/**
 * First-class setup-token mint + seed (PHNX-2364).
 *
 * Closes the mint-auth manual recipe: drive `claude setup-token` through the
 * same injectable PTY driver `agents fleet login` uses, capture a well-formed
 * `sk-ant-oat01-…` token (the #1767 ANSI-banner guard), and seed BOTH:
 *
 *   1. a named provider account (`agents accounts add` shape, policy never)
 *   2. the reserved FILE-BASED `auth` bundle keyed per-account email, which
 *      usage/probe reads (`resolveClaudeSetupToken`)
 *
 * Native rotating OAuth is never copied. Only this non-rotating class is
 * stored and optionally synced. Interactive mint is Claude-only; every other
 * harness fails loud with the command that actually provisions it.
 */
import type { AgentId } from './types.js';
import { type CredentialAccount } from './account-registry.js';
import { type DriveOptions, type PtyDriver } from './fleet/remote-login.js';
/** Well-formed Claude setup-token as it appears inside a TTY blob. */
export declare const CLAUDE_SETUP_TOKEN_CAPTURE_RE: RegExp;
export interface MintFlow {
    harness: AgentId;
    provider: string;
    auth: 'setup-token';
    /** Interactive mint argv after HOME=… <bin>. Null when stdin-seed only. */
    mintArgs: string[] | null;
    verificationUrlRegex: RegExp;
    tokenCapture: RegExp;
}
/**
 * Harnesses that expose an interactive setup-token mint. Native device-code
 * login (codex/droid/kimi/grok) stays on `agents fleet login`; API keys stay
 * on `agents accounts add`. Adding a harness here without a real mint command
 * is a lying table — do not.
 */
export declare const MINT_FLOWS: Record<string, MintFlow>;
export declare function listMintableHarnesses(): AgentId[];
export declare function getMintFlow(harnessRaw: string): MintFlow;
export declare function unmintableMessage(harness: string): string;
/** Strip CSI / Fe ANSI so a #1767 TTY blob can be scanned for a real token. */
export declare function stripAnsi(text: string): string;
/**
 * Pull a single well-formed Claude setup-token out of a (possibly ANSI-wrapped)
 * screen. Returns null when none is present. Two distinct tokens fail loud —
 * guessing which one to seed is how a banner fragment becomes an auth header.
 */
export declare function extractClaudeSetupToken(screen: string): string | null;
/** First https URL on the screen, trailing punctuation stripped. */
export declare function extractMintUrl(screen: string, flow: MintFlow): string | undefined;
export declare function isEmail(value: string): boolean;
/** Account-name slug of an email (`ada@example.com` → `ada-at-example.com`). */
export declare function accountNameFromEmail(email: string): string;
export declare function assertValidSetupToken(token: string): string;
export interface ResolveMintIdentityInput {
    account?: string;
    email?: string;
    home?: string;
}
export interface ResolvedMintIdentity {
    accountName: string;
    email: string;
}
/**
 * Resolve the named account + the email that keys the reserved `auth` bundle.
 * `--account` that looks like an email is the email; a name needs `--email` or
 * a locally signed-in `.claude.json`. Missing email fails loud — we must not
 * fall back to a bare shared key (that is the multi-account mix-up).
 */
export declare function resolveMintIdentity(input: ResolveMintIdentityInput): ResolvedMintIdentity;
/**
 * Write (or rotate) the reserved FILE-BASED `auth` bundle's per-account key.
 * Usage/probe ignores a keychain- or vault-backed bundle of this name, so a
 * wrong backend fails loud instead of looking like a successful mint.
 */
export declare function seedReservedAuthToken(email: string, token: string): {
    key: string;
};
/**
 * Create or rotate the named provider account that `agents run --account` and
 * `agents accounts sync` consume. Existing account of a different kind fails
 * loud rather than silently overwriting an API key with a setup-token.
 */
export declare function seedNamedAccount(name: string, token: string, flow: MintFlow): CredentialAccount;
export interface MintDriveHooks {
    driver?: PtyDriver;
    openUrl?: (url: string) => Promise<void>;
    /** Asked once the authorize URL is on screen, when `--code` was not given. */
    readCode?: () => Promise<string | undefined>;
    drive?: DriveOptions;
}
export interface DriveMintResult {
    token: string;
    url?: string;
    sessionId: string;
}
export interface DriveSetupTokenMintOpts extends MintDriveHooks {
    code?: string;
    /** Suppress stdout progress so `--json` callers get a parseable blob. */
    json?: boolean;
}
/**
 * Drive `claude setup-token` in a PTY: scrape the authorize URL, open it,
 * optionally paste `--code`, then capture the token with the #1767 guard.
 * Tears the session down on the way out (success, timeout, or throw).
 */
export declare function driveSetupTokenMint(command: string, flow: MintFlow, opts?: DriveSetupTokenMintOpts): Promise<DriveMintResult>;
export declare function buildMintCommand(flow: MintFlow, bin: string, home: string): string;
export declare function resolveMintInstallation(harness: AgentId): {
    version: string;
    bin: string;
    home: string;
};
export interface MintAndSeedInput {
    harness: string;
    account?: string;
    email?: string;
    token?: string;
    code?: string;
    open?: boolean;
    fleet?: boolean;
    devices?: string[];
    /** Suppress progress prints so `--json` stdout stays machine-parseable. */
    json?: boolean;
    hooks?: MintDriveHooks;
}
export interface FleetSyncRow {
    device: string;
    ok: boolean;
    message: string;
}
export interface MintAndSeedResult {
    harness: AgentId;
    account: string;
    email: string;
    authBundleKey: string;
    rotated: boolean;
    fleet: FleetSyncRow[];
}
/**
 * End-to-end mint: resolve identity, obtain a token (stdin or PTY drive),
 * seed the named account + reserved auth bundle, optionally sync the fleet.
 * Never returns or logs the token.
 */
export declare function mintAndSeed(input: MintAndSeedInput): Promise<MintAndSeedResult>;
export declare function resolveSyncTargets(fleet: boolean, devices: string[]): Promise<string[]>;
/**
 * True when a Claude setup-token is already seeded on this box (setup status).
 *
 * Read-only status probe (`agents setup`, `agents doctor`) — the reserved
 * auth-bundle check below MUST NOT crash the whole command because the
 * keychain could not be reached (e.g. the macOS Keychain helper source is
 * unavailable — PHNX-3385); `bundleExists()`/`hasKeychainToken()` document
 * themselves as failing loud, but that contract is for destructive-write
 * guards, not a diagnostic. An unreachable keychain here just means "cannot
 * confirm the reserved bundle," reported honestly rather than propagated.
 */
export declare function hasMintedSetupToken(): {
    ready: boolean;
    detail: string;
};
