/**
 * `clustly login` / `clustly logout` — command glue for the auth flows (GUIDELINES §2; design
 * clustly-cli.md §4; build-plan 3.3). Wires the real world (browser opener, stdin, env base
 * URLs) into hosting/auth/login.ts, which owns the sequencing. Also exports the lazy
 * interactive login that `clustly deploy` uses (design: "there is no upfront login step").
 */
import { type Credentials } from "../hosting/auth/credentials";
import { type CliFailure } from "../hosting/cli-failure";
/**
 * The interactive sign-in `login` and `deploy` share: builds real deps (browser, the [d]+Enter
 * device switch on stdin) and ALWAYS releases stdin afterwards so the wizard's readline can
 * take over.
 */
export declare function interactiveLogin(forceDevice: boolean): Promise<Credentials>;
/**
 * A failed interactive sign-in, classified.
 *
 * `failureFrom` maps a bare Error to PLATFORM — right for a network or server fault, wrong for a
 * device code that simply timed out: that is NOT_SIGNED_IN (origin `state`, exit 3), whose catalog
 * fix already reads "Run `clustly login`". Production 2026-09-20 showed the expiry filed under the
 * red ours-to-fix badge on a builder who took longer than the window.
 *
 * Every caller of `interactiveLogin` routes through here so the three of them cannot disagree.
 */
export declare function loginFailure(e: unknown): CliFailure;
/**
 * Exits follow the same contract as every other command (commands/failure.ts): a typo is
 * USAGE (2), a failed sign-in is the catalog failure with its exit, success is 0 — and
 * `--json` is honoured. Before 2026-09-16 every login failure exited 1 ("platform, retry"), so
 * an agent driving the CLI retried `--dry-runn` forever (CLI audit, verified on the built CLI).
 */
export declare function loginCommand(usage: string): Promise<void>;
/**
 * Sign out = revoke the key server-side, THEN forget it locally. Before the revoke existed, a
 * "signed out" laptop still held a live credential on the server (CLI audit 2026-09-16). The
 * local delete never waits on the network: an unreachable API still ends the local session,
 * and says so, because the builder can revoke from any other signed-in machine.
 */
export declare function logoutCommand(): Promise<void>;