/**
 * Token resolution with precedence chain.
 *
 * Resolves authentication tokens from multiple sources in priority order:
 * 1. AXM_TOKEN environment variable
 * 2. AXM_TOKEN_FILE
 * 3. --token flag (per-command, passed as parameter)
 * 4. Credential store lookup by registry URL
 *
 * @experimental This API is unstable and may change without notice.
 */
import * as Effect from "effect/Effect";
import * as Option from "effect/Option";
import { type AppError } from "../app-error/index.js";
import { type Handle } from "../extensions/handle.js";
import { AuthClient } from "./auth-client.js";
import { CredentialStore } from "./credential-store.js";
import { CredentialStoreTokenSource, type TokenSource } from "./schema.js";
/**
 * Read the locally-stored user handle for the given registry URL.
 *
 * Offline only — does not call the registry. Returns Option.none() when
 * persisted credentials are unsupported, no credentials are stored, or the
 * stored entry has no handle.
 */
export declare const getCurrentUserHandle: (registryUrl: string) => Effect.Effect<Option.Option<Handle>, AppError, CredentialStore>;
/**
 * Resolve a token from the credential store only.
 *
 * Looks up stored credentials by origin URL. Does not check env vars or flags.
 */
export declare const resolveStoredToken: (origin: string) => Effect.Effect<Option.Option<CredentialStoreTokenSource>, AppError, CredentialStore>;
export declare const refreshStoredToken: (tokenSource: CredentialStoreTokenSource) => Effect.Effect<CredentialStoreTokenSource, AppError, CredentialStore | AuthClient>;
/**
 * Resolve a token from ambient sources only (env var, file, and flag).
 *
 * Does not access the credential store.
 *
 * Precedence:
 * 1. AXM_TOKEN env var
 * 2. AXM_TOKEN_FILE
 * 3. --token flag (passed as `flagToken` parameter)
 */
export declare const resolveAmbientToken: (flagToken?: string) => Effect.Effect<Option.Option<TokenSource>, AppError, never>;
/**
 * Resolve the token that should be attached to a specific request target.
 *
 * Ambient sources are only considered for the configured default registry.
 * Stored credentials remain scoped by request origin.
 */
export declare const resolveRequestToken: (requestUrl: string, defaultRegistryUrl: string, flagToken?: string) => Effect.Effect<Option.Option<TokenSource>, AppError, CredentialStore>;
/**
 * Resolve a token from the precedence chain.
 *
 * Precedence:
 * 1. AXM_TOKEN env var
 * 2. AXM_TOKEN_FILE
 * 3. --token flag (passed as `flagToken` parameter)
 * 4. CredentialStore lookup by registry URL
 *
 * Returns the stored token as-is without proactive refresh. Callers should
 * handle 401 responses from the server (e.g., prompt re-login). The auth
 * middleware handles automatic refresh on 401 for requests going through
 * HttpClient.
 *
 * Returns `Option.none()` when no token is available from any source.
 */
export declare const resolveToken: (registryUrl: string, flagToken?: string) => Effect.Effect<Option.Option<TokenSource>, AppError, CredentialStore>;
/**
 * Resolve a token and fail with the correct auth policy error when none is available.
 *
 * In CI environments, persisted credentials are disabled by policy, so
 * callers should surface the auth policy error instead of suggesting `axm login`.
 */
export declare const resolveRequiredToken: (registryUrl: string, options?: {
    readonly flagToken?: string;
    readonly missingTokenError?: AppError;
}) => Effect.Effect<TokenSource, AppError, CredentialStore>;
//# sourceMappingURL=token-resolution.d.ts.map