/** PI_CODING_AGENT_DIR: PI reads models.json, auth.json from this dir. */
export declare const PI_AGENT_DIR: string;
export declare const PI_SESSIONS_DIR: string;
export declare const PI_MODELS_PATH: string;
/**
 * One provider entry to write into the cortex-controlled `models.json`. cortex uses PI's
 * "Override Built-in Providers" mechanism (docs/models.md §Overriding Built-in Providers):
 * specifying only `baseUrl` redirects all of that provider's traffic to our gateway while
 * keeping PI's built-in model catalog and OAuth/API-key auth resolution from auth.json intact.
 */
export interface ProviderOverride {
    /** PI provider name (e.g. "anthropic", "deepseek", "openai-codex"). */
    name: string;
    /**
     * Path segment appended to the gateway URL. Defaults to `/${name}`.
     * Set explicitly when a provider needs to land on a non-standard gateway path
     * (e.g. deepseek's anthropic-compat endpoint: `/deepseek/anthropic`).
     */
    basePath?: string;
    /**
     * Per-spawn PI compat flags to write into this provider's models.json entry.
     * Merged ON TOP of PROVIDER_COMPAT_OVERRIDES (explicit wins). Normally unset —
     * the static table covers the known cases.
     */
    compat?: Record<string, unknown>;
}
export interface WriteProvidersOpts {
    /** Override target file path. Defaults to PI_MODELS_PATH. */
    modelsPath?: string;
}
/**
 * Atomic-write models.json with multi-provider baseUrl overrides. Each provider entry has a
 * `baseUrl` pointing to `<gatewayUrl><basePath>`; no apiKey is written so PI resolves credentials
 * from auth.json (or environment variables) per PI's auth resolution order.
 *
 * Called by PIAdapter.spawn() — sole writer of this file, no other code path touches it.
 */
export declare function writeProvidersConfig(providers: ProviderOverride[], gatewayUrl: string, opts?: WriteProvidersOpts): void;
/**
 * Compute the set of PI providers whose baseUrl should be overridden to the gateway for a spawn.
 *
 * Design: "route through gateway" and "PI has credentials" are independent concerns. Discovery
 * (`pi --list-models`) only reports providers the user is authenticated to, but a profile may
 * legitimately route a provider through the gateway even without direct PI credentials (the
 * gateway injects managed keys). So the override set is the union of:
 *   - `discovered`        — providers PI reports creds for (credential passthrough via auth.json)
 *   - `currentProvider`   — the provider THIS spawn uses (`--provider`); it MUST be routed, always
 *
 * `gatewayPath`, when set, becomes the current provider's `basePath` (decouples the gateway route
 * from the provider name — e.g. provider "anthropic" landing on "/deepseek-anthropic"). It wins
 * over the default `/<name>` even if the current provider was also discovered.
 */
export declare function buildProviderOverrides(discovered: string[], currentProvider: string | null, gatewayPath?: string | null): ProviderOverride[];
export interface EnsureAuthVisibleOpts {
    /** Source: where the user's PI auth.json lives. Defaults to ~/.pi/agent/auth.json. */
    userAuthPath?: string;
    /** Target dir (PI_CODING_AGENT_DIR). Defaults to PI_AGENT_DIR. */
    agentDir?: string;
}
/**
 * Make the user's PI OAuth/API-key credentials visible to the PI subprocess running under
 * cortex's PI_CODING_AGENT_DIR. Uses symlink on Linux/macOS so PI's automatic OAuth refresh
 * writes back to the user's canonical location. Falls back to file copy on Windows.
 *
 * Idempotent: a correctly-pointed symlink is preserved; a stale file/symlink is replaced.
 * Silently no-ops when the user has not logged into PI (no source auth.json).
 */
export declare function ensureAuthVisible(opts?: EnsureAuthVisibleOpts): void;
export declare function ensurePIAgentDirs(): void;