/** `PUT /v1/model-auth/{provider}` body — a discriminated union over credential
 *  kind. Idempotent upsert/rotate keyed by provider (and `account_id` for a
 *  managed account). */
export type InstallCredentialRequest = {
    kind: 'api_key';
    api_key: string;
} | {
    kind: 'oauth';
    access_token: string;
    /** Required — pi's `OAuthCredentials` always carries both; the handler is
     *  fail-loud (400) when either is absent, so the type matches (no lenient
     *  fallback). */
    refresh_token: string;
    expires_at: string;
    account_id?: string;
    /** Provider-specific credential keys beyond the canonical tokens (e.g.
     *  github-copilot's `enterpriseUrl`), retained for enterprise routing and
     *  token refresh. */
    extra?: Record<string, unknown>;
} | {
    kind: 'managed_account';
    /** Optional requested label. A bare provider login automatically labels a newly seen
     *  account from its identity profile. */
    label?: string;
    auto_label?: boolean;
    account_id?: string;
    access_token: string;
    /** Required — the managed login always returns both; the handler is
     *  fail-loud (400) when either is absent. */
    refresh_token: string;
    expires_at: string;
    /** Causal-cooldown floor snapshotted before the interactive login flow. Epoch ms. */
    last_rate_limited_at?: number;
};
/** Result of a credential install/rotate. */
export interface CredentialResultDTO {
    provider: string;
    installed: true;
    managed: boolean;
    account_id?: string;
}