/**
 * Credential storage for OAuth tokens.
 * Handles loading, saving, and refreshing credentials from auth.json.
 *
 * Uses file locking to prevent race conditions when multiple agent instances
 * try to refresh tokens simultaneously.
 */
import { type OAuthCredentials, type OAuthLoginCallbacks, type OAuthProviderId } from '../../ai/utils/oauth/index.js';
export type OAuthCredential = {
    type: 'oauth';
} & OAuthCredentials;
export type AuthCredential = OAuthCredential;
export type AuthStorageData = Record<string, AuthCredential>;
type LockResult<T> = {
    result: T;
    next?: string;
};
export type GetApiKeyOptions = {
    forceRefresh?: boolean;
    rejectedApiKey?: string;
};
export interface AuthStorageOptions {
    authPath?: string;
    externalCredentialStores?: ExternalAuthCredentialStore[];
}
export interface ExternalAuthCredentialStore {
    owns(provider: string): boolean;
    reload(): void;
    listProviders(): string[];
    has(provider: string): boolean;
    get(provider: string): AuthCredential | undefined;
    set(provider: string, credential: AuthCredential): void;
    remove(provider: string): void;
    mutateCredentialWithLock<T>(provider: string, mutate: (credential: AuthCredential | undefined) => Promise<{
        result: T;
        credential?: AuthCredential;
    }>): Promise<T>;
}
export interface AuthStorageBackend {
    withLock<T>(fn: (current: string | undefined) => LockResult<T>): T;
    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T>;
}
export declare class FileAuthStorageBackend implements AuthStorageBackend {
    private authPath;
    constructor(authPath?: string);
    private ensureParentDir;
    private ensureFileExists;
    withLock<T>(fn: (current: string | undefined) => LockResult<T>): T;
    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T>;
}
/**
 * Read-only file backend for subagents.
 * Reads auth.json without file locking to avoid contention when multiple
 * subagents spawn concurrently. Never writes — the parent process owns
 * token refresh and persists updated credentials.
 */
export declare class ReadOnlyFileAuthStorageBackend implements AuthStorageBackend {
    private authPath;
    constructor(authPath?: string);
    withLock<T>(fn: (current: string | undefined) => LockResult<T>): T;
    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T>;
}
export declare class InMemoryAuthStorageBackend implements AuthStorageBackend {
    private value;
    withLock<T>(fn: (current: string | undefined) => LockResult<T>): T;
    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T>;
}
/**
 * Credential storage backed by a JSON file.
 */
export declare class AuthStorage {
    private storage;
    private data;
    private runtimeOverrides;
    private fallbackResolver?;
    private loadError;
    private errors;
    private _readOnly;
    private readonly externalCredentialStores;
    private constructor();
    static create(authPathOrOptions?: string | AuthStorageOptions): AuthStorage;
    static fromStorage(storage: AuthStorageBackend, options?: AuthStorageOptions): AuthStorage;
    /**
     * Create a read-only AuthStorage backed by auth.json.
     * Reads without file locking — safe for concurrent subagents.
     * Never writes or refreshes tokens; call reload() periodically
     * to pick up tokens refreshed by the parent process.
     */
    static createReadOnly(authPathOrOptions?: string | AuthStorageOptions): AuthStorage;
    static inMemory(data?: AuthStorageData, options?: AuthStorageOptions): AuthStorage;
    /**
     * Set a runtime API key override (not persisted to disk).
     * Used for CLI --api-key flag.
     */
    setRuntimeApiKey(provider: string, apiKey: string): void;
    /**
     * Remove a runtime API key override.
     */
    removeRuntimeApiKey(provider: string): void;
    /**
     * Set a fallback resolver for API keys not found in auth.json or env vars.
     * Used for custom provider keys from models.json.
     */
    setFallbackResolver(resolver: (provider: string) => string | undefined): void;
    private getExternalCredentialStore;
    private parseStorageData;
    private parseStorageDocument;
    private recordError;
    /**
     * Reload credentials from storage.
     */
    reload(): void;
    private persistProviderChange;
    /**
     * Get credential for a provider.
     */
    get(provider: string): AuthCredential | undefined;
    /**
     * Set credential for a provider.
     */
    set(provider: string, credential: AuthCredential): void;
    /**
     * Remove credential for a provider.
     */
    remove(provider: string): void;
    /**
     * List all providers with credentials.
     */
    list(): string[];
    /**
     * Check if stored credentials exist for a provider.
     */
    has(provider: string): boolean;
    /**
     * Check if any form of auth is configured for a provider.
     * Only checks OAuth/stored credentials and runtime overrides — ignores
     * environment variables so that e.g. ANTHROPIC_API_KEY doesn't cause
     * Anthropic models to appear when the user hasn't logged in via OAuth.
     */
    hasAuth(provider: string): boolean;
    /**
     * Get all credentials (for passing to getOAuthApiKey).
     */
    getAll(): AuthStorageData;
    drainErrors(): Error[];
    /**
     * Login to an OAuth provider.
     */
    login(providerId: OAuthProviderId, callbacks: OAuthLoginCallbacks): Promise<void>;
    /**
     * Logout from a provider.
     */
    logout(provider: string): void;
    /**
     * Refresh OAuth token with backend locking to prevent race conditions.
     * Multiple pi instances may try to refresh simultaneously when tokens expire.
     */
    private refreshOAuthTokenWithLock;
    /**
     * Mark a provider's token as needing refresh on the next getApiKey() call.
     * Used by the agent loop to force a refresh after a 401 from the backend.
     */
    invalidateToken(providerId: string): void;
    /**
     * Get API key for a provider.
     * Priority:
     * 1. Runtime override (CLI --api-key)
     * 2. OAuth token from persisted storage (auto-refreshed with locking)
     * 3. Environment variable
     * 4. Fallback resolver (models.json custom providers)
     */
    getApiKey(providerId: string, options?: GetApiKeyOptions): Promise<string | undefined>;
}
export {};
//# sourceMappingURL=auth-storage.d.ts.map