import { SecureStoreUnavailableError } from '@doist/cli-core/auth';
import { type AuthMode } from './config.js';
import { CliError } from './errors.js';
export { SecureStoreUnavailableError };
export declare const TOKEN_ENV_VAR = "TWIST_API_TOKEN";
export declare const SECURE_STORE_DESCRIPTION = "system credential manager";
export type TokenStorageLocation = 'secure-store' | 'config-file';
export type TokenStorageResult = {
    storage: TokenStorageLocation;
    warning?: string;
};
export type AuthMetadata = {
    authMode: AuthMode;
    authScope?: string;
    authUserId?: number;
    authUserName?: string;
    source: 'env' | 'config';
};
export type AuthProbeMetadata = {
    authMode: AuthMode;
    authScope?: string;
    authUserId?: number;
    authUserName?: string;
    source: 'env' | 'config-file' | 'secure-store';
};
export type AuthProbeResult = {
    token: string;
    metadata: AuthProbeMetadata;
};
export declare class NoTokenError extends CliError {
    constructor();
}
/** Read the active token. The store wraps env-var precedence internally. */
export declare function getApiToken(): Promise<string>;
/** Token + metadata in one round-trip for `tw config view` / `tw doctor`. */
export declare function probeApiToken(): Promise<AuthProbeResult>;
/**
 * Auth metadata for `tw auth status` and `ensureWriteAllowed`. Falls back
 * to v1 flat fields when no v2 record exists so a legacy `read-only` token
 * isn't reported as `'unknown'` — that would skip the local READ_ONLY guard.
 */
export declare function getAuthMetadata(): Promise<AuthMetadata>;
//# sourceMappingURL=auth.d.ts.map