import type { AuthCredential } from "@gajae-code/ai/core";
/** gjc provider ids that external credentials map onto. */
export type ExternalProvider = "anthropic" | "openai-codex";
/** Where a discovered credential came from. */
export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file";
export declare const AUTO_IMPORT_OAUTH_PROVIDER_ORIGINS: Record<ExternalProvider, ReadonlySet<CredentialOrigin>>;
/** Human labels for providers, used in redacted summaries. */
export declare const EXTERNAL_PROVIDER_LABELS: Record<ExternalProvider, string>;
/** A credential that can be safely imported into gjc's store. */
export interface ImportableCredential {
    provider: ExternalProvider;
    origin: CredentialOrigin;
    /** Redacted, human-readable description of where this came from. */
    source: string;
    kind: AuthCredential["type"];
    identity?: {
        email?: string;
        accountId?: string;
    };
    /** Epoch-ms expiry for OAuth credentials, when known. */
    expiresAt?: number;
    /** Redacted access token / API key — safe to display. */
    redactedToken: string;
    /** Opaque credential payload. Never include this in any summary output. */
    credential: AuthCredential;
}
/** A source that was found but could not be imported. */
export interface SkippedCredential {
    origin: CredentialOrigin;
    source: string;
    reason: string;
}
/** Ambient environment-backed auth that is already usable without import. */
export interface EnvironmentCredentialHint {
    provider: ExternalProvider;
    variable: string;
    redactedValue: string;
}
export interface CredentialDiscoveryResult {
    importable: ImportableCredential[];
    skipped: SkippedCredential[];
    environment: EnvironmentCredentialHint[];
}
export interface DiscoveryOptions {
    /** Override the home directory (defaults to `os.homedir()`). */
    homeDir?: string;
    /** Override the environment (defaults to `process.env`). */
    env?: Record<string, string | undefined>;
    /** Override the platform (defaults to `process.platform`). */
    platform?: NodeJS.Platform;
    /**
     * Claude Code config directory holding `.credentials.json`.
     *
     * Defaults to the trusted `CLAUDE_CONFIG_DIR` value, else `<homeDir>/.claude`.
     */
    claudeConfigDir?: string;
    /**
     * Codex CLI home directory holding `auth.json`.
     *
     * Defaults to the trusted `CODEX_HOME` value, else `<homeDir>/.codex`.
     */
    codexHome?: string;
    /**
     * Reader for the macOS Keychain `Claude Code-credentials` entry. Defaults to
     * shelling out to `security`; injected in tests. Returns the raw JSON string,
     * or `null` when no entry exists.
     */
    readClaudeKeychain?: () => Promise<string | null>;
}
export type CredentialUpserter = (provider: string, credential: AuthCredential) => unknown | Promise<unknown>;
export interface ImportSummary {
    imported: ImportableCredential[];
    failed: Array<{
        credential: ImportableCredential;
        error: string;
    }>;
}
/**
 * Discover Claude Code and Codex CLI credentials across files, the macOS
 * Keychain, and environment variables. Never throws for individual unreadable or
 * malformed sources — those land in {@link CredentialDiscoveryResult.skipped}.
 */
export declare function discoverExternalCredentials(options?: DiscoveryOptions): Promise<CredentialDiscoveryResult>;
/** Redacted one-line summary of an importable credential. Never includes secrets. */
export declare function formatCredentialSummary(credential: ImportableCredential): string;
/** Redacted summary lines for an entire discovery result. Never includes secrets. */
export declare function formatDiscoverySummary(result: CredentialDiscoveryResult): string[];
/** Reason shown when automatic OAuth import rejects an unusable discovery record. */
export declare const INVALID_AUTO_IMPORT_OAUTH_EXPIRY_REASON = "OAuth credential has no valid future expiry";
export declare function isAutoImportOAuthCredential(credential: ImportableCredential, now?: number): boolean;
/** Keep rejected OAuth discoveries visible to operators without offering them for automatic import. */
export declare function getAutoImportOAuthCredentialSkips(credentials: readonly ImportableCredential[], now?: number): SkippedCredential[];
export declare function filterAutoImportOAuthCredentials(credentials: readonly ImportableCredential[]): ImportableCredential[];
/**
 * Persist discovered credentials via `upsert`. Each credential is imported
 * independently; a failure on one is recorded without aborting the rest.
 */
export declare function importCredentials(credentials: readonly ImportableCredential[], upsert: CredentialUpserter): Promise<ImportSummary>;