import { AuthStorage } from "../auth-storage";
export interface AuthBrokerClientConfig {
    url: string;
    token: string;
}
export interface ResolveAuthBrokerConfigOptions {
    agentDir?: string;
    configValueResolver?: (config: string) => Promise<string | undefined>;
}
export interface DiscoverAuthStorageOptions {
    agentDir?: string;
    configValueResolver?: (config: string) => Promise<string | undefined>;
    cachePath?: string;
    sourceLabel?: string;
}
/** Path to the local bearer token file. Created by `omp auth-broker token`. */
export declare function getAuthBrokerTokenFilePath(): string;
/**
 * Resolve broker connection configuration using the same precedence as the TUI:
 *
 * 1. `OMP_AUTH_BROKER_URL` / `OMP_AUTH_BROKER_TOKEN` env vars.
 * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml`.
 * 3. `<config-root>/auth-broker.token` file (paired with a URL from env/config).
 *
 * Returns `null` when no broker URL is configured — callers should fall back to
 * the local SQLite store. Throws when a URL is configured but no token is
 * available, matching the TUI behavior.
 */
export declare function resolveAuthBrokerConfig(options?: ResolveAuthBrokerConfigOptions): Promise<AuthBrokerClientConfig | null>;
/**
 * Create an AuthStorage instance, using the broker when configured and falling
 * back to the local SQLite store otherwise. This is the single source of truth
 * for the TUI and the catalog generator.
 */
export declare function discoverAuthStorage(options?: DiscoverAuthStorageOptions): Promise<AuthStorage>;