/** Env keys that authenticate Copilot CLI (`COPILOT_GITHUB_TOKEN`) or `gh` (any). */
export declare const COPILOT_AUTH_KEYS: readonly ["COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN"];
/**
 * First Copilot/gh auth token from `env` only (default process.env). Used by
 * the live network validator so file-sourced secrets never enter an outbound
 * request. Returns undefined when none of the known keys are set.
 */
export declare function findCopilotAuthTokenFromEnv(env?: NodeJS.ProcessEnv): string | undefined;
/**
 * First Copilot/gh auth token from `<homeDir>/.omp/.env` only. Used for
 * presence/warning checks when env loading was skipped; never passed to
 * {@link validateCopilotToken}.
 */
export declare function findCopilotAuthTokenFromFile(homeDir?: string): string | undefined;
/**
 * The first Copilot/gh auth token available to an unattended run: from `env`
 * (default process.env) or, failing that, from `<homeDir>/.omp/.env` (default
 * the real home). Returns undefined when no token is configured. Fails open to
 * undefined (callers only warn) and never throws.
 *
 * Prefer {@link findCopilotAuthTokenFromEnv} when the value will be sent on the
 * network (see {@link validateCopilotToken}).
 */
export declare function findCopilotAuthToken(env?: NodeJS.ProcessEnv, homeDir?: string): string | undefined;
/** True when a Copilot/gh auth token is configured (see {@link findCopilotAuthToken}). */
export declare function copilotAuthConfigured(env?: NodeJS.ProcessEnv, homeDir?: string): boolean;
/** Result of a live token check. "unknown" covers offline, timeout, and unexpected statuses. */
export type CopilotTokenVerdict = "valid" | "invalid" | "unknown";
/**
 * Best-effort validity check of a GitHub token against `api.github.com/user`
 * (the lightest authenticated endpoint; works for the OAuth/PAT tokens gh and
 * Copilot CLI use). 2xx → "valid", 401/403 → "invalid", anything else —
 * network error, timeout, unexpected status — → "unknown" so an offline
 * machine never produces a scary warning. Never throws.
 *
 * Callers must pass an env-sourced token (via {@link findCopilotAuthTokenFromEnv}),
 * not a value read from disk, so static analysis does not treat this as file
 * data exfiltration.
 */
export declare function validateCopilotToken(token: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<CopilotTokenVerdict>;