/**
 * `auth` — a small OAuth helper command.
 *
 * A few providers (notably Anthropic and OpenAI) let a user sign in through a
 * browser authorization-code flow rather than pasting a long-lived API key. This
 * command drives that flow from the terminal and keeps the resulting tokens in
 * the profile's credential store. It exposes three subcommands:
 *
 *   - `login <provider>`   — start the PKCE authorization-code flow: mint a PKCE
 *                            pair, print the authorization URL for the user to
 *                            open, accept the pasted authorization code, trade it
 *                            for tokens, and persist them.
 *   - `refresh <provider>` — use a stored refresh token to mint a fresh access
 *                            token, then write the rotated credentials back.
 *   - `status [provider]`  — report which providers currently hold stored
 *                            credentials (and whether each looks expired).
 *
 * The PKCE math and the OAuth wire calls are imported from the gateway's
 * credential layer; this module only owns the terminal choreography, the
 * credential store on disk, and the help/error text.
 *
 * The interactive and network steps are intentionally thin. Reading the pasted
 * code and the HTTP round-trips are funnelled through the {@link AuthIO} seam and
 * the gateway helpers respectively, so this file stays deterministic, typed, and
 * free of any direct `process`/TTY coupling beyond what the caller injects.
 */
import type { ProviderId } from "../../llmgateway";
/**
 * The minimal terminal surface the command needs. Kept as an interface so the
 * launcher can hand in a real readline-backed implementation while tests pass a
 * scripted stub. The command never touches `process.stdout`/`stdin` directly.
 */
export interface AuthIO {
    /** Write one line of normal output (followed by a newline). */
    print(line: string): void;
    /** Write one line of diagnostic output (followed by a newline). */
    warn(line: string): void;
    /**
     * Prompt the user and resolve with the line they typed (without the trailing
     * newline). The `prompt` is shown verbatim before reading. Returns an empty
     * string if the input stream closed without a line.
     */
    ask(prompt: string): Promise<string>;
}
/**
 * One provider's persisted OAuth credentials, plus a little bookkeeping. This is
 * a superset of {@link OAuthTokens} so a stored record round-trips cleanly
 * through the gateway helpers.
 */
export interface StoredCredential {
    readonly accessToken: string;
    readonly refreshToken?: string;
    /** Absolute epoch-millisecond expiry deadline, if the server supplied one. */
    readonly expiresAt?: number;
    /** Epoch-millisecond timestamp of the last successful write. */
    readonly updatedAt: number;
}
/**
 * The on-disk shape of the credential store: a map from provider id to its
 * stored credential. Serialized as pretty JSON at {@link Locator.authStorePath}.
 */
export interface CredentialStore {
    readonly providers: Partial<Record<ProviderId, StoredCredential>>;
}
/**
 * Run the `auth` command.
 *
 * @param argv The argument slice *after* the `auth` word — e.g. for
 *   `indusagi auth login anthropic`, pass `["login", "anthropic"]`.
 * @param io   The terminal seam to read prompts from and write output to.
 * @returns A process exit code: `0` success, `2` bad usage, `1` runtime failure.
 */
export declare function runAuthCommand(argv: readonly string[], io: AuthIO): Promise<number>;
