/** `PUT /v1/model-auth/{provider}` body — a discriminated union over credential
 *  kind. Idempotent upsert/rotate keyed by provider (and `account_id` for a
 *  managed account). */
export type InstallCredentialRequest = {
    kind: 'api_key';
    api_key: string;
} | {
    kind: 'oauth';
    access_token: string;
    /** Required — pi's `OAuthCredentials` always carries both; the handler is
     *  fail-loud (400) when either is absent, so the type matches (no lenient
     *  fallback). */
    refresh_token: string;
    expires_at: string;
    account_id?: string;
    /** Provider-specific credential keys beyond the canonical tokens (e.g.
     *  github-copilot's `enterpriseUrl`), retained for enterprise routing and
     *  token refresh. */
    extra?: Record<string, unknown>;
} | {
    kind: 'managed_account';
    /** Optional requested label. A bare provider login automatically labels a newly seen
     *  account from its identity profile. */
    label?: string;
    auto_label?: boolean;
    account_id?: string;
    access_token: string;
    /** Required — the managed login always returns both; the handler is
     *  fail-loud (400) when either is absent. */
    refresh_token: string;
    expires_at: string;
    /** Causal-cooldown floor snapshotted before the interactive login flow. Epoch ms. */
    last_rate_limited_at?: number;
};
/** Result of a credential install/rotate. */
export interface CredentialResultDTO {
    provider: string;
    installed: true;
    managed: boolean;
    account_id?: string;
}
/** One managed-pool account, projected without credential material. Timestamps are
 * ISO strings so remote consumers do not need to understand pi's epoch-ms storage. */
export interface ManagedAccountStatusDTO {
    label: string;
    expires_at: string;
    rate_limited_until: string;
    auth_failure?: 'invalid_grant';
    account_id?: string;
}
/** A provider's sanitized credential state. Managed providers are always listed
 * (even with no accounts); non-managed providers appear only when auth.json has
 * an API-key or OAuth credential for them. */
export type ModelAuthProviderStatusDTO = {
    provider: string;
    managed: true;
    configured: boolean;
    accounts: ManagedAccountStatusDTO[];
} | {
    provider: string;
    managed: false;
    configured: true;
    kind: 'api_key' | 'oauth';
};
/** `GET /v1/model-auth` — credential-presence projection for every known provider. */
export interface ModelAuthListDTO {
    providers: ModelAuthProviderStatusDTO[];
}
/** Inputs that select the exact provider a new root node would use. */
export interface ModelAuthReadinessQuery {
    profile?: string;
    cwd?: string;
    kind?: string;
    model?: string;
}
/** `GET /v1/model-auth/readiness` — credential state for the provider selected by a prospective root launch. */
export interface ModelAuthReadinessDTO {
    provider: string;
    model: string;
    credential: 'ready' | 'missing' | 'unusable';
    reason?: 'invalid_grant';
    rate_limited_until?: string | null;
}
/** `DELETE /v1/model-auth/{provider}` — all user credentials removed for one provider. */
export interface CredentialRemovalResultDTO {
    provider: string;
    removed_accounts: number;
}