/**
 * Resolve a set of candidate paths (supports `~/` prefix) against the user's
 * home directory and return the first one that exists.
 */
export declare function findExistingAuthFile(candidates: string[]): Promise<string | null>;
export type AuthMethod = 'api_key' | 'oauth' | 'config_file';
export interface AuthIdentityInfo {
    filePath: string;
    identity: string;
    method: AuthMethod;
    hasRefreshToken?: boolean;
    expiresAt?: number;
}
/**
 * Best-effort decode of a JWT payload (no signature verification). Returns
 * the parsed payload object, or null if the input doesn't look like a JWT.
 */
export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
/**
 * Inspect a parsed auth-config object and return a best-effort identity +
 * method. Recognized shapes:
 *
 *  - Top-level api key: `{ apiKey | OPENAI_API_KEY | … }`
 *  - OAuth nested:      `{ tokens: { access_token, refresh_token, id_token, … } }`
 *  - OAuth flat:        `{ access_token, refresh_token, id_token, expiry_date }`
 *  - Email present:     `{ email: "you@…" }` or JWT id_token containing email
 */
export declare function parseAuthConfig(parsed: unknown, tokenKeys?: string[]): {
    identity: string | null;
    method: AuthMethod;
    hasRefreshToken: boolean;
    expiresAt?: number;
};
/**
 * Read an agent auth config file (if present) and attempt to extract a
 * recognizable identity. Returns null if no candidate exists.
 */
export declare function readAuthConfigIdentity(candidates: string[], tokenKeys?: string[]): Promise<AuthIdentityInfo | null>;
/**
 * Probe the OS keychain (via optional `keytar`) for a credential. Returns
 * null when keytar is not installed, the lookup fails, or no entry exists.
 * Never throws — keytar is treated as a soft optional dependency.
 */
export declare function tryKeychainLookup(service: string, account: string): Promise<string | null>;