/**
 * Credential seeder for the GitHub CLI (`gh`)
 * (E-CONFIG-AUTH-UNIFY E2a / T9418).
 *
 * ## DISABLED — T9594
 *
 * This seeder is intentionally NOT registered in `BUILTIN_SEEDERS` until a
 * real `github-models` provider exists in CLEO.  The token returned by
 * `gh auth token` is a GitHub Personal Access Token (`ghp_*` / `gho_*`) that
 * **cannot authenticate against `api.openai.com`**.  Tagging the entry as
 * `provider:'openai'` created unusable pool entries.
 *
 * Re-enable by:
 *   1. Implementing a `github-models` transport in `packages/core/src/llm/`.
 *   2. Changing `readonly provider = 'openai'` below to `'github-models'` (or
 *      whichever id the transport registers under).
 *   3. Adding `BUILTIN_SEEDERS.register(ghCliSeeder)` back to `./index.ts`.
 *
 * The file is kept in tree so the `readGhAuthToken` helper and the
 * `GhCliSeeder` class are available for the future provider without a
 * `git revert`.
 *
 * ## Security note
 *
 * MUST use `execFileSync` (not `execSync`) so the `gh` invocation cannot
 * be hijacked by shell metacharacters in the working directory or
 * environment. No arguments are interpolated from user input.
 *
 * ## Failure model
 *
 * Every failure path resolves to `{ entries: [] }`:
 *   - `gh` not installed (`ENOENT` on spawn) → silent skip
 *   - `gh auth token` exits non-zero (no logged-in account, scope mismatch,
 *     etc.) → silent skip
 *   - `gh` hangs → 2-second timeout terminates the child and skips
 *   - any other unexpected error → captured warning, still skipped
 *
 * This matches the rest of the seeder cohort: absence of the upstream tool
 * MUST never crash the resolver.
 *
 * @module llm/credential-seeders/gh-cli-seeder
 * @task T9418
 * @task T9594 (disabled — see note above)
 * @epic E-CONFIG-AUTH-UNIFY (E2a)
 */
import type { CredentialSeeder, SeederResult } from './index.js';
/**
 * Run `gh auth token` and return its trimmed stdout, or `null` on any
 * failure (tool absent, non-zero exit, timeout, etc.).
 *
 * Factored out so tests can stub `execFileSync` via `vi.mock('node:child_process')`
 * without needing to instantiate the seeder class.
 *
 * @internal
 * @task T9418
 */
export declare function readGhAuthToken(): {
    token: string | null;
    warning?: string;
};
/**
 * Credential seeder for the GitHub CLI (`gh`).
 *
 * Returns at most one entry: the token captured from `gh auth token`. The
 * entry is labelled `'gh-cli'` so the resolver and removal flows can
 * round-trip the source identity through the credential store.
 *
 * @task T9418
 */
export declare class GhCliSeeder implements CredentialSeeder {
    readonly sourceId: "gh-cli";
    readonly provider = "openai";
    /**
     * Invoke `gh auth token` and shape the result for the resolver.
     *
     * Never throws — see the module docstring for the failure-mode table.
     *
     * @returns Zero or one entry plus optional warning.
     * @task T9418
     */
    seed(): Promise<SeederResult>;
}
/**
 * Module-level singleton registered into `BUILTIN_SEEDERS`.
 *
 * @task T9418
 */
export declare const ghCliSeeder: CredentialSeeder;
//# sourceMappingURL=gh-cli-seeder.d.ts.map