import type { AuthMethod } from "@agentclientprotocol/sdk";
import type { SpawnConfig } from "../backend.js";
/** Host-agnostic, fully type-dispatched view of one advertised `AuthMethod`. ZERO backend branching. */
export type AuthMethodDescriptor = {
    type: "agent";
    id: string;
    name: string;
    description?: string;
    /** true iff the advertised `authMethods[]._meta` block is present (a `_meta` object exists —
     *  gateway OR api-key convention). Whether it is *gateway-shaped* is a SEPARATE test that
     *  drives `klass` (§2.1), not `expectsMeta`. */
    expectsMeta: boolean;
    meta?: Record<string, unknown>;
    /** true iff this is a bare `agent` method (no `_meta`) that runs its OWN login via the
     *  authenticate RPC — which may open a browser or need a TTY (e.g. codex `chat-gpt`).
     *  Derived as `!expectsMeta`. Headless hosts (MCP/SDK) use this to SKIP a method they cannot
     *  complete instead of mapping it to a no-op (§4.3). */
    interactive: boolean;
} | {
    type: "terminal";
    id: string;
    name: string;
    description?: string;
    /** How the host spawns the interactive login. Base fills from EITHER the conventional
     *  `_meta["terminal-auth"] {command,args,label}` (preferred; not an SDK schema field), OR the
     *  agent binary + `AuthMethodTerminal.args`/`env` (spec baseline). */
    launch: {
        command: string;
        args: string[];
        env?: Record<string, string>;
        label?: string;
    };
    meta?: Record<string, unknown>;
};
/** The host-collected outcome of one auth step. `env`/`meta` payloads are SECRET (Principle 9). */
export type AuthResolution = {
    outcome: "completed";
    methodId?: string;
} | {
    outcome: "agent-login";
    methodId: string;
} | {
    outcome: "env";
    values: Record<string, string>;
    methodId?: string;
} | {
    outcome: "meta";
    methodId: string;
    meta: Record<string, unknown>;
} | {
    outcome: "cancelled";
};
export interface AuthContext {
    readonly backendId: string;
    readonly label?: string;
    /** All advertised methods, already dispatched by `buildAuthDescriptors`. */
    readonly methods: readonly AuthMethodDescriptor[];
    /** `required` = we hit -32000; `proactive` = pre-run enumeration. */
    readonly cause: "required" | "proactive";
    readonly signal?: AbortSignal;
}
/** The host-facing inline auth resolver hook. Mirrors PermissionResolver / ElicitationResolver. */
export type AuthResolver = (ctx: AuthContext) => Promise<AuthResolution> | AuthResolution;
/** The conventional in-process gateway key (`_meta.gateway`) claude+codex attach to a gateway
 *  method. Its PRESENCE (a gateway-shaped `_meta`) is what makes us classify a method `in-process`
 *  (§2.1). Recognized by literal name; NOT an SDK schema field. */
export declare const GATEWAY_META_KEY = "gateway";
/** A `_meta` object counts as gateway-shaped iff it carries the literal `gateway` key with a
 *  non-null value. This is the single discriminant behind `in-process` classification (§2.1);
 *  codex `api-key` carries a `_meta["api-key"]` block and is therefore NOT gateway-shaped. */
export declare function isGatewayShapedMeta(meta: Record<string, unknown> | null | undefined): boolean;
/** Pure, agent-agnostic per-method dispatcher (§1.3): maps each advertised `AuthMethod` to an
 *  `AuthMethodDescriptor` with NO agent identity. `spawn` supplies the terminal-launch fallback
 *  (the agent binary + `AuthMethodTerminal.args`). */
export declare function buildAuthDescriptors(methods: readonly AuthMethod[], spawn: SpawnConfig): AuthMethodDescriptor[];
export declare function buildAuthDescriptor(method: AuthMethod, spawn: SpawnConfig): AuthMethodDescriptor;
//# sourceMappingURL=auth-types.d.ts.map