export declare const PROVIDER_AUTH_STATUS_SCHEMA: "mono-agent.provider-auth.v1";
export declare const PROVIDER_AUTH_SESSION_SCHEMA: "mono-agent.provider-auth-session.v1";
export declare const PROVIDER_AUTH_CHECK_SCHEMA: "mono-agent.provider-auth-check.v1";
export declare const MAX_PROVIDER_AUTH_BODY_BYTES: number;
export declare const MAX_PROVIDER_AUTH_INPUT_BYTES = 65536;
export declare const MAX_PROVIDER_AUTH_TEXT_INPUT_BYTES: number;
export declare const MAX_PROVIDER_AUTH_ITEMS = 64;
export declare const MAX_PROVIDER_AUTH_USAGES = 64;
export declare const MAX_PROVIDER_AUTH_METHODS = 8;
export declare const MAX_PROVIDER_AUTH_OPTIONS = 32;
export declare const MAX_PROVIDER_AUTH_STRING_BYTES = 4096;
export type ProviderAuthState = "present" | "expired" | "missing" | "not_applicable";
export type ProviderAuthVerification = "not_verified" | "verified_by_live_request" | "not_applicable";
export type ProviderAuthType = "oauth" | "api_key";
export type ProviderAuthStrategy = "device_code" | "paste_back" | "provider_prompt" | "api_key_prompt";
export type ProviderAuthSessionState = "pending" | "awaiting_input" | "awaiting_user" | "succeeded" | "failed" | "cancelled";
export type ProviderAuthCheckSessionState = "running" | "completed" | "cancelled";
export type ProviderAuthCheckResultState = "pending" | "running" | "passed" | "auth_failed" | "network_failed" | "quota_limited" | "model_not_entitled" | "inconclusive" | "unsupported" | "timeout" | "cancelled" | "stale" | "not_run";
export type ProviderAuthCheckSelectionBasis = "catalog_pricing" | "subscription_zero_price" | "sole_candidate_unknown_price";
export type ProviderAuthCheckResultCode = "passed" | "credential_rejected" | "provider_unavailable" | "quota_limited" | "model_not_entitled" | "forbidden" | "inconclusive" | "cancelled" | "provider_unsupported" | "no_eligible_model" | "pricing_unavailable" | "timeout" | "stale" | "not_run";
export interface ProviderAuthUsage {
    readonly kind: "primary" | "fallback" | "memory_llm" | "cron" | "webhook";
    readonly model: string;
    readonly label: string;
}
export interface ProviderAuthMethod {
    readonly authType: ProviderAuthType;
    readonly strategy: ProviderAuthStrategy;
    readonly label: string;
    readonly recommended: boolean;
}
export interface ProviderAuthProviderStatus {
    readonly providerId: string;
    readonly label: string;
    readonly usages: readonly ProviderAuthUsage[];
    readonly state: ProviderAuthState;
    readonly credentialType?: ProviderAuthType;
    readonly source?: "stored" | "environment" | "ambient" | "config";
    readonly expiresAt?: string;
    readonly verification: ProviderAuthVerification;
    readonly verifiedAt?: string;
    readonly methods: readonly ProviderAuthMethod[];
    readonly unavailableReason?: string;
    readonly lastFailure?: {
        readonly kind: "provider_auth" | "provider_unavailable";
        readonly message: string;
        readonly model: string;
        readonly observedAt: string;
    };
}
export interface ProviderAuthStatusSnapshot {
    readonly schema: typeof PROVIDER_AUTH_STATUS_SCHEMA;
    readonly generatedAt: string;
    readonly providers: readonly ProviderAuthProviderStatus[];
}
export interface ProviderAuthPrompt {
    readonly id: string;
    readonly type: "text" | "secret" | "select" | "manual_code";
    readonly message: string;
    readonly placeholder?: string;
    /** Only provider-declared optional text prompts may be submitted blank. */
    readonly allowEmpty?: boolean;
    readonly options?: readonly {
        readonly id: string;
        readonly label: string;
        readonly description?: string;
    }[];
}
export interface ProviderAuthSessionSnapshot {
    readonly schema: typeof PROVIDER_AUTH_SESSION_SCHEMA;
    readonly id: string;
    readonly providerId: string;
    readonly authType: ProviderAuthType;
    readonly strategy: ProviderAuthStrategy;
    readonly state: ProviderAuthSessionState;
    readonly createdAt: string;
    readonly updatedAt: string;
    readonly expiresAt: string;
    readonly authUrl?: {
        readonly url: string;
        readonly instructions: string;
    };
    readonly deviceCode?: {
        readonly verificationUri: string;
        readonly userCode: string;
        readonly expiresAt?: string;
    };
    readonly prompt?: ProviderAuthPrompt;
    readonly progress?: string;
    readonly error?: {
        readonly code: string;
        readonly message: string;
    };
}
export interface ProviderAuthSessionStartInput {
    readonly providerId: string;
    readonly authType: ProviderAuthType;
    readonly strategy: ProviderAuthStrategy;
}
export interface ProviderAuthSessionInput {
    readonly promptId: string;
    /** Secret-bearing. Implementations must never return, log, or retain this value after consumption. */
    readonly value: string;
}
export interface ProviderAuthCheckStartInput {
    readonly idempotencyKey: string;
}
export interface ProviderAuthCheckResult {
    readonly providerId: string;
    readonly label: string;
    readonly state: ProviderAuthCheckResultState;
    readonly model?: string;
    readonly selectionBasis?: ProviderAuthCheckSelectionBasis;
    readonly checkedAt?: string;
    readonly code?: ProviderAuthCheckResultCode;
    readonly message?: string;
}
export interface ProviderAuthCheckSessionSnapshot {
    readonly schema: typeof PROVIDER_AUTH_CHECK_SCHEMA;
    readonly id: string;
    readonly state: ProviderAuthCheckSessionState;
    readonly createdAt: string;
    readonly updatedAt: string;
    readonly expiresAt: string;
    readonly results: readonly ProviderAuthCheckResult[];
}
export interface ProviderAuthCheckOperator {
    start(input: ProviderAuthCheckStartInput): Promise<ProviderAuthCheckSessionSnapshot>;
    get(checkId: string): Promise<ProviderAuthCheckSessionSnapshot | undefined>;
    cancel(checkId: string): Promise<void>;
}
export interface ProviderAuthOperator {
    status(): Promise<ProviderAuthStatusSnapshot>;
    /**
     * A semantically valid start replaces the active authentication session.
     * Invalid starts leave an existing session untouched; live checks remain a
     * separate conflict that callers must cancel explicitly.
     */
    start(input: ProviderAuthSessionStartInput): Promise<ProviderAuthSessionSnapshot>;
    get(sessionId: string): Promise<ProviderAuthSessionSnapshot | undefined>;
    submit(sessionId: string, input: ProviderAuthSessionInput): Promise<ProviderAuthSessionSnapshot>;
    cancel(sessionId: string): Promise<void>;
    readonly checks?: ProviderAuthCheckOperator;
    stop(): Promise<void>;
}
export type ProviderAuthErrorCode = "provider_auth_invalid_request" | "provider_auth_not_found" | "provider_auth_conflict" | "provider_auth_too_large" | "provider_auth_rate_limited" | "provider_auth_upstream" | "provider_auth_unavailable";
export declare class ProviderAuthOperationError extends Error {
    readonly code: ProviderAuthErrorCode;
    readonly status: 400 | 404 | 409 | 413 | 429 | 502 | 503;
    readonly retryAfterSeconds?: number;
    constructor(code: ProviderAuthErrorCode, message: string, status: ProviderAuthOperationError["status"], retryAfterSeconds?: number);
}
export declare function isTerminalProviderAuthSessionState(value: ProviderAuthSessionState): boolean;
export declare function parseProviderAuthStatusSnapshot(value: unknown): ProviderAuthStatusSnapshot;
export declare function parseProviderAuthSessionSnapshot(value: unknown): ProviderAuthSessionSnapshot;
export declare function parseProviderAuthSessionStartInput(value: unknown): ProviderAuthSessionStartInput;
export declare function parseProviderAuthSessionInput(value: unknown): ProviderAuthSessionInput;
export declare function parseProviderAuthCheckStartInput(value: unknown): ProviderAuthCheckStartInput;
export declare function parseProviderAuthCheckSessionSnapshot(value: unknown): ProviderAuthCheckSessionSnapshot;
//# sourceMappingURL=provider-auth.d.ts.map