/// <reference types="node" resolution-mode="require"/>
import { type AccessTokenProvider } from "./accessToken.js";
import type { StoredCredentials } from "./credentials.js";
export type AuthCredentials = {
    accessToken?: string;
    workspaceUuid?: string;
    baseUrl?: string;
    appUrl?: string;
};
export type AuthTokenSource = "environment" | "credentials-file" | "none";
export type ResolvedAuthConfig = {
    accessToken: string | undefined;
    baseUrl: string;
    /** Where the web app is served — for the pages the CLI opens in a browser. */
    appUrl: string;
    workspaceUuid: string | undefined;
    tokenSource: AuthTokenSource;
};
export declare const DEFAULT_BASE_URL = "https://api.getcargo.io";
export declare const DEFAULT_APP_URL = "https://app.getcargo.io";
/**
 * Resolve auth fields from env + credentials.
 *
 * When `CARGO_API_TOKEN` is set (explicitly or via project `.env`), workspace
 * and base URL come only from env too — never from the credentials file. The
 * credentials file's workspace belongs to the personal login and must not
 * short-circuit token-bound workspace resolution.
 */
export declare function resolveAuthConfig(env: NodeJS.ProcessEnv, credentials: AuthCredentials | undefined): ResolvedAuthConfig;
export type ResolvedAuth = ResolvedAuthConfig & {
    /**
     * Resolves the token for each request, renewing an expiring session first.
     * `undefined` when there is no credential at all, which is how callers
     * detect "not signed in".
     */
    getAccessToken: AccessTokenProvider | undefined;
    /** True when the credential is pinned to one workspace by the server. */
    isWorkspaceBoundToken: boolean;
};
/**
 * `resolveAuthConfig` plus the token accessor. A credential from the
 * environment is always a static API token; only the credentials file can
 * hold a session that renews itself.
 */
export declare function resolveAuth(env: NodeJS.ProcessEnv, credentials: StoredCredentials | undefined): ResolvedAuth;
//# sourceMappingURL=resolveAuthConfig.d.ts.map