import type { Command } from 'commander';
import type { AgentId } from '../lib/types.js';
import { collectRunCandidates, type RotateCandidate } from '../lib/accounting/rotate.js';
import { type Profile } from '../lib/profiles.js';
import { type UnifiedAccount } from '../lib/account-registry.js';
export declare function nativeIdentityFromSource(raw: string): Promise<{
    agent: AgentId;
    version: string;
    identityKey: string;
    identityLabel?: string;
    scope: 'version' | 'device';
}>;
type AttachTarget = {
    kind: 'installation';
    agent: AgentId;
    version: string;
} | {
    kind: 'device-agent';
    agent: AgentId;
} | {
    kind: 'profile';
    profile: Profile;
};
/**
 * Classify + validate an attach target, rejecting a typo BEFORE any binding is
 * written: it must be an existing custom-harness profile, an installed
 * `agent@version`, or a known harness id.
 */
export declare function classifyAttachTarget(target: string): AttachTarget;
/**
 * Persist the attached setup-token to a per-version `.oauth_token` file so an
 * INTERACTIVE Claude launch on a keychain-less Linux worker can authenticate from it.
 * Headless runs inject the token via `buildExecEnv`. Since PHNX-3502 an interactive
 * launch on a worker-role device ALSO injects it through `claudeAdapter.applyExecConfigEnv`
 * (only a headed `personal`/`desktop` device defers to its per-version native login), and
 * the shim's Linux fallback (`claudeAdapter.shimConfigEnvBash`) reads exactly this file —
 * so writing it is what makes a freshly-attached setup-token visible to that shim fallback
 * on a worker. macOS keeps the credential in the keychain, so `resolveClaudeSetupToken`
 * returns null there and this is a no-op off Linux.
 */
export declare function writeClaudeInteractiveOauthToken(target: AttachTarget, targetAgent: AgentId, email?: string): void;
export declare function parseBundleKey(raw: string): {
    bundle: string;
    key: string;
};
/** Pure text renderer for `agents accounts list` — grouped, column-aligned, labels first-class. */
export declare function renderAccountList(records: {
    name: string;
    provider: string;
    auth: string;
}[], native: {
    agent: AgentId;
    name?: string;
    display: string;
    versions: string[];
}[]): string;
/** One labelable signed-in identity, folded across every version it is signed into. */
export interface LabelIdentity {
    identityKey: string;
    email: string | null;
    versions: string[];
    isDefault: boolean;
}
/**
 * Fold signed-in run candidates into distinct identities — the unit a label
 * binds to. The same account signed into several versions is ONE row, so a
 * multi-version single-account harness never demands a selector. Candidates
 * with no stable identity (no accountKey, no email) are dropped: there is
 * nothing durable for a label to bind to. Default-version identity first.
 */
export declare function groupLabelIdentities(candidates: Pick<RotateCandidate, 'version' | 'email' | 'accountKey'>[], defaultVersion: string | null): LabelIdentity[];
export type LabelSelection = {
    kind: 'selected';
    identity: LabelIdentity;
} | {
    kind: 'ambiguous';
    identities: LabelIdentity[];
};
/**
 * Resolve which signed-in login a bare-harness `accounts label` call means.
 * `collect` is injectable (the `resolveRunVersion` pattern) so tests drive the
 * real selection path against fixture candidates.
 */
export declare function resolveLabelIdentity(agent: AgentId, accountSelector: string | undefined, collect?: typeof collectRunCandidates): Promise<LabelSelection>;
/**
 * Body of `accounts label`, exported with the injectable candidate collector
 * so tests exercise everything but the TTY prompt itself.
 */
export declare function runAccountsLabel(source: string, label: string | undefined, opts: {
    account?: string;
}, collect?: typeof collectRunCandidates): Promise<void>;
/** Named accounts that `set-default` / `switch` can pin for this harness. */
export declare function listSwitchableAccounts(agent: AgentId): Promise<UnifiedAccount[]>;
/**
 * Pin the per-harness default. Shared by `accounts set-default` and `accounts switch`.
 * Provider accounts must authenticate the harness; native accounts must belong to it.
 */
export declare function setDefaultAccount(agentRaw: string, name: string): {
    agent: AgentId;
    account: UnifiedAccount;
};
export declare function runAccountsSwitch(harness: string, accountName: string | undefined, opts: {
    json: boolean;
}): Promise<void>;
export declare function registerAccountsCommand(program: Command): void;
export {};
