import type { AuthInteraction } from "@bastani/pi-ai";
import type { AgentSession } from "../../core/agent-session.js";
import { type AtomicOAuthLoginCallbacks } from "../../core/oauth-login.ts";
import type { RpcClient } from "../rpc/rpc-client.ts";
import type { RemoteModelCatalog } from "./remote-model-catalog.ts";
export type { AtomicOAuthLoginCallbacks } from "../../core/oauth-login.ts";
/** Acquire and persist OAuth entirely in the engine, transporting only UI callbacks and catalog metadata. */
export declare function loginIsolatedOAuthProvider(session: AgentSession, client: RpcClient, catalog: RemoteModelCatalog, provider: string, callbacks: AtomicOAuthLoginCallbacks): Promise<{
    modelsRefreshed: true;
}>;
/**
 * Acquire an API key with the frontend's login dialog, then persist it in the engine.
 *
 * The engine owns credential storage for the isolated runtime, so the frontend
 * only collects the key and adopts the engine's catalog and credential snapshot
 * afterwards. A dialog cancelled before the engine save is sent persists nothing on
 * either side; once the save is in flight it completes and the login is reported, the
 * same commit point the local credential store uses. The engine save
 * deliberately skips the remote catalog refresh: catalog freshness belongs to
 * /model's bounded background refresh, and a failed fetch would otherwise leave the
 * key persisted in the engine while the frontend took the error branch.
 *
 * An extension provider is registered only in the engine, so its own login runs there and asks
 * for the key through the engine's input form.
 */
export declare function loginIsolatedApiKeyProvider(session: AgentSession, client: RpcClient, catalog: RemoteModelCatalog, provider: string, interaction: AuthInteraction): Promise<{
    modelsRefreshed: true;
}>;
//# sourceMappingURL=isolated-auth.d.ts.map