/**
 * olam auth — Manage the local auth container (the long-lived Linux container
 * that runs the same OAuth PKCE dance as the Cloudflare Worker and stores
 * Claude tokens in a named docker volume).
 *
 * Subcommands (local):
 *   olam auth up                  — start the auth container (idempotent)
 *   olam auth down                — stop the auth container
 *   olam auth status              — show container state + account summary
 *   olam auth login               — run PKCE login flow (one-time per host)
 *   olam auth logout              — remove an account from the container
 *   olam auth refresh             — force-refresh a token
 *
 * Subcommands (remote auth-worker — e4/e5/e6):
 *   olam auth login --remote <url>                   — print OAuth URL to open in browser (v1 dogfood)
 *   olam auth bind-service-token --remote <url> ...  — bind a CF service token to a user sub
 *   olam auth list --remote <url>                    — list accounts + service tokens on remote worker
 *   olam auth migrate-to-remote --url <url>          — guidance: re-OAuth each local account remotely
 *   olam auth rotate-service-token --url <url> ...   — revoke + re-bind a service token
 *   olam auth doctor --auth-worker <url>             — 4-probe health check against the auth-worker
 *
 * V1 dogfood note (e4/e5):
 *   CF Access cookie-bridging is the core UX constraint.  Full CLI-orchestrated
 *   browser flow (the CLI as its own OAuth client for CF Access) is complex and
 *   deferred to v2.  V1 uses a "print the URL; operator completes in browser;
 *   CLI re-checks via list --remote" model for login, and a "paste cookie from
 *   DevTools" model for service-token binding.
 */
import type { Command } from 'commander';
export declare function registerAuth(program: Command): void;
//# sourceMappingURL=auth.d.ts.map