/**
 * Vigil CLI — Trenchwork Account Authentication
 *
 * Supports:
 *   - /login with Trenchwork account via Lambda API
 *   - Token caching to ~/.vigil/auth.json
 *   - Login status checks
 *   - Provider key validation (DeepSeek, Tavily)
 */
export interface AuthState {
    uid: string;
    email: string;
    token: string;
    refreshToken: string;
    tokenExpiresAt: number;
    displayName?: string;
    loggedInAt: number;
}
export interface ProviderStatus {
    provider: string;
    envVar: string;
    configured: boolean;
    validated: boolean;
    error?: string;
    maskedKey?: string;
}
/**
 * Check if the user is currently logged in with a valid token.
 */
export declare function isLoggedIn(): boolean;
/**
 * Get the current auth state, or null if not logged in.
 */
export declare function getAuthState(): AuthState | null;
/**
 * Store auth state to disk.
 */
export declare function saveAuthState(state: AuthState): void;
/**
 * Clear auth state (logout).
 */
export declare function clearAuthState(): void;
/**
 * Sign in with email + password via Firebase Auth REST API,
 * then exchange the Firebase ID token for a Trenchwork account session.
 */
export declare function signIn(email: string, password: string): Promise<AuthState>;
/**
 * Refresh the ID token using the refresh token.
 */
export declare function refreshAuthToken(): Promise<AuthState | null>;
/**
 * Validate that DeepSeek and Tavily API keys are present and working.
 */
export declare function validateApiKeys(): Promise<ProviderStatus[]>;
/**
 * Check if both required API keys are working.
 */
export declare function allKeysValid(): Promise<boolean>;
/**
 * Build a formatted status string for the welcome banner.
 */
export declare function buildLoginStatusLine(): Promise<string>;
/**
 * Authorization tier interfaces.
 */
export type AuthTier = 'level1' | 'level2' | 'level3';
/**
 * 检查当前用户是否被授权使用给定的能力层级。
 * 基于等保2.0（GB/T 22239-2019）：一级=自主保护，二级=指导保护，三级=监督保护
 */
export declare function isAuthorizedFor(_tier: AuthTier): boolean;
/**
 * Require authorization — throws if not authorized.
 */
export declare function requireAuthorization(_tier: AuthTier): void;
/**
 * Update AuthState interface to include authorization tiers.
 */
declare module './auth.js' {
    interface AuthState {
        level2?: boolean;
        level3?: boolean;
    }
}
//# sourceMappingURL=auth.d.ts.map