/**
 * Public authentication options for SDK consumers.
 *
 * - `accessToken`: User provides a personal access token directly.
 * - `accessToken` with `{ envVar }`: SDK reads a personal access token from
 *   an environment variable.
 * - `qodercli`: Reuse the local qodercli login state (read-only).
 */
export type AccessTokenInput = string | {
    envVar: string;
};
export type ServiceAccountKeyInput = string | {
    envVar: string;
};
export type ServiceAccountTokenResult = {
    token: string;
    /** Absolute expiration time as a Unix timestamp in milliseconds. */
    expiresAt?: number;
};
export type FetchServiceAccountToken = () => Promise<ServiceAccountTokenResult | null>;
export type ServiceAccountCredentials = {
    serviceAccountKey: ServiceAccountKeyInput;
    fetchServiceAccountToken?: never;
} | {
    serviceAccountKey?: never;
    fetchServiceAccountToken: FetchServiceAccountToken;
};
export type ServiceAccountAuthOptions = {
    type: 'serviceAccount';
} & ServiceAccountCredentials;
export type AuthOptions = {
    type: 'accessToken';
    accessToken: AccessTokenInput;
} | {
    type: 'qodercli';
} | ServiceAccountAuthOptions;
export type JobTokenRequest = {
    requestId: string;
    reason: 'initial' | 'unauthorized';
    sessionId?: string;
};
export type JobTokenResult = {
    token: string;
};
export type FetchJobToken = (request: JobTokenRequest, options: {
    signal: AbortSignal;
}) => Promise<JobTokenResult | null>;
export type JobTokenAuthOptions = {
    type: 'jobToken';
    fetchJobToken: FetchJobToken;
};
/**
 * Full set of authentication options accepted by `options.auth`.
 * Extends public `AuthOptions` with `JobTokenAuthOptions` for first-party
 * host integrations.
 */
export type InternalAuthOptions = AuthOptions | JobTokenAuthOptions;
/**
 * The JSON structure written to the one-shot auth payload file.
 * CLI reads this, initializes auth, then immediately deletes the file.
 */
export type SdkAuthPayload = {
    type: 'accessToken';
    accessToken: string;
} | {
    type: 'qodercli';
} | {
    type: 'jobToken';
    jobTokenProvider: 'host';
} | {
    type: 'serviceAccount';
    serviceAccountKey: string;
} | {
    type: 'serviceAccount';
    serviceAccountTokenProvider: 'host';
};