import { type CredentialStore } from "@bastani/pi-ai";
import { ModelRuntime } from "../core/model-runtime.js";
import type { Args } from "./args.ts";
import { Secret } from "./credential-print.ts";
export type AuthCheckStatus = "ready" | "not_ready" | "invalid";
export type AuthCheckReason = "provider_not_found" | "credentials_not_configured" | "credential_expired" | "credential_not_available" | "invalid_state";
export type AuthCheckResult = {
    status: "ready";
    provider: string;
    authType: "api_key" | "oauth";
} | {
    status: "not_ready";
    provider: string;
    reason: AuthCheckReason;
} | {
    status: "invalid";
    provider?: string;
    reason: "invalid_state";
};
export declare function checkProviderAuth(args: Args, modelRuntime: ModelRuntime, options?: {
    refresh: boolean;
    credentials?: CredentialStore;
}): Promise<AuthCheckResult>;
/**
 * A credential export must name one target, not accept the CLI resolver's fuzzy
 * cross-provider match. Provider flags are explicit; a model-only export is
 * explicit only when its exact reference resolves uniquely to the provider.
 */
export declare function hasExplicitCredentialExportTarget(args: Args, modelRuntime: ModelRuntime, provider: string): boolean;
/** Resolve the credential that the checked provider would use, without exposing it to callers. */
export declare function getProviderCredential(providerId: string, modelRuntime: ModelRuntime, credentials: CredentialStore, options: {
    refresh: boolean;
}): Promise<Secret | undefined>;
export declare function createAuthCheckModelRuntime(credentials: CredentialStore): Promise<ModelRuntime>;
//# sourceMappingURL=auth-check.d.ts.map