import { type BaseCredential, type OAuthClientInfo } from "@lobu/core";
export type { OAuthClientInfo };
export interface Credentials extends BaseCredential {
    email?: string;
    name?: string;
    userId?: string;
    /** Local-init worker PAT used only by the gateway agent API. */
    localWorkerToken?: string;
}
export declare function loadCredentials(contextName?: string): Promise<Credentials | null>;
export declare function saveCredentials(creds: Credentials, contextName?: string): Promise<void>;
export declare function clearCredentials(contextName?: string): Promise<void>;
/**
 * Get token from env var (CI/CD) or stored credentials.
 * Automatically refreshes expired tokens and clears stale credentials.
 *
 * For loopback contexts with no stored creds, transparently POSTs
 * /api/local-init to mint a fresh Better Auth session for the
 * embedded bootstrap user. Agent API callers should use getAgentApiToken(),
 * which returns the companion worker PAT when local-init provides one.
 */
export declare function getToken(contextName?: string): Promise<string | null>;
/**
 * Resolve one named context's own credential without the process-wide
 * `LOBU_API_TOKEN` override. Cross-context callers use this so a token meant
 * for the active local runtime is never forwarded to a Cloud context.
 */
export declare function getContextToken(contextName?: string): Promise<string | null>;
/**
 * Token for the gateway agent API (`/lobu/api/v1/agents/*`). Local embedded
 * installs need the worker PAT from /api/local-init for that surface, while
 * admin REST + MCP need the Better Auth session token returned by getToken().
 */
export declare function getAgentApiToken(contextName?: string): Promise<string | null>;
export declare function refreshCredentials(existing?: Credentials | null, contextName?: string): Promise<Credentials | null>;
//# sourceMappingURL=credentials.d.ts.map