import { type AccountRef, type AuthAccount, type AuthProvider, type KeyringTokenStore } from '@doist/cli-core/auth';
import { type AuthMode } from './config.js';
export declare const AUTHORIZATION_URL = "https://twist.com/oauth/authorize";
export declare const TOKEN_URL = "https://twist.com/oauth/access_token";
export declare const REGISTRATION_URL = "https://twist.com/oauth/register";
export declare const READ_WRITE_SCOPES: string[];
export declare const READ_ONLY_SCOPES: string[];
/**
 * The scope set a login is granted, as a pure function of `--read-only`. Single
 * source of truth shared by `attachTwistLoginCommand`'s `resolveScopes` (what we
 * request at authorize) and the provider's `validate` (what we record on the
 * account), so the two can't drift.
 */
export declare function getScopes(readOnly: boolean): string[];
/**
 * Narrow account shape: only fields that round-trip through the local token
 * store. `id` is the stringified numeric Twist user id (so cli-core's
 * `AuthAccount.id` string contract holds), `label` is the user's display
 * name. Richer session-user details are fetched on demand via the API
 * rather than threaded through the auth flow.
 */
export type TwistAccount = AuthAccount & {
    id: string;
    label: string;
    authMode: AuthMode;
    authScope: string;
};
export type TwistTokenStore = KeyringTokenStore<TwistAccount>;
/**
 * Twist's OAuth flow uses RFC 7591 Dynamic Client Registration: each login
 * mints a fresh `client_id` / `client_secret`, then runs the standard PKCE
 * authorize + token exchange (HTTP Basic auth on the token endpoint). cli-core's
 * `createDcrProvider` drives all of that via `oauth4webapi`; the only
 * twist-specific piece is `validate`, which probes `getSessionUser` and records
 * the auth mode/scope the login was granted.
 *
 * `authMode` / `authScope` are derived from `handshake.readOnly` (folded in by
 * `runOAuthFlow`) rather than threaded through `authorize`, because the scope
 * set is itself a pure function of `readOnly` (see `resolveScopes` in login.ts).
 */
export declare function createTwistAuthProvider(): AuthProvider<TwistAccount>;
/**
 * Accepts `42`, `id:42`, and case-insensitive labels — `parseRef` normalises
 * the numeric forms. Broader than cli-core's default strict-equality matcher.
 */
export declare function matchTwistAccount(account: TwistAccount, ref: AccountRef): boolean;
/**
 * True when the v2 store is empty but a legacy v1 token snapshot is still
 * the only thing keeping the CLI authenticated — typically because
 * `migrateLegacyAuth` couldn't reach the Twist API to identify the account
 * (`MigrateSkipReason: 'identify-failed'`). Account-management commands
 * use this to fail with a dedicated `AUTH_MIGRATION_PENDING` envelope
 * instead of a misleading `ACCOUNT_NOT_FOUND`.
 */
export declare function isLegacyAuthActive(): Promise<boolean>;
/**
 * Resolve a `ref` against the v2 store, returning the canonical account.
 * Throws `ACCOUNT_NOT_FOUND` on a miss. Shared between the `tw account ...`
 * commands and `withUserRefAware` so the same hint reaches every caller.
 */
export declare function findAccountInStore(store: TwistTokenStore, ref: AccountRef): Promise<TwistAccount>;
/**
 * `TWIST_API_TOKEN` short-circuits `active()` only when no explicit ref is
 * supplied — cli-core's `KeyringTokenStore` doesn't know about the env var,
 * and an explicit ref means the caller targets a specific stored account.
 *
 * `ensureMigrated()` runs on every stored-state op so `--ignore-scripts`
 * installs still migrate on first command. When migration isn't conclusive:
 *  - `active()` falls back to the legacy snapshot, honouring `ref` so it
 *    can't resolve to a different account than the caller asked for.
 *  - `set()` / `clear()` discharge legacy state on disk first so v2 writes
 *    aren't shadowed by a stale v1 token on the next read.
 */
export declare function createTwistTokenStore(): TwistTokenStore;
/**
 * Where the currently-active token lives. Returns `'config-file'` whenever
 * a plaintext token is on disk — including the legacy `config.token` slot —
 * so doctor/config-view reports the security-relevant state accurately.
 */
export declare function getActiveTokenSource(): Promise<'env' | 'secure-store' | 'config-file'>;
//# sourceMappingURL=auth-provider.d.ts.map