/**
 * Auth — environment-scoped bearer-key resolution.
 *
 * The bearer model is unchanged from 1.x. `Authorization: Bearer <token>`
 * on the WS upgrade and HTTP routes; QAR forwards to qodo-platform.
 * The SDK's job is to produce a valid bearer when asked, and to throw
 * a typed error when it can't.
 *
 * Multiple `QodoClient` instances can run in the same Node.js process (Studio,
 * IDE extension, CI runner all in one host). Each holds an `AuthProvider`
 * instance so they don't trample each other's keys via module-level state.
 */
/** Where the bearer came from. Used in error messages so consumers know what to fix. */
export type AuthSource = 'env' | 'file' | 'explicit';
/** Resolved bearer + provenance. Returned by `AuthProvider.getAuthConfig()`. */
export interface AuthConfig {
    readonly token: string;
    readonly source: AuthSource;
}
/**
 * Auth-related failure. Constructor signature unchanged from 1.x for binary
 * compatibility with existing handlers (Studio, IDE extension catch by `name`).
 */
export declare class QodoAuthError extends Error {
    readonly name = "QodoAuthError";
    constructor(message: string);
}
/**
 * Resolves and validates a Qodo API key.
 *
 * Resolution order:
 *   1. Explicit `apiKey` argument to the constructor (`source: 'explicit'`).
 *   2. `QODO_API_KEY` environment variable (`source: 'env'`).
 *   3. `~/.qodo/auth.key` (`source: 'file'`).
 *
 * `validate()` is the lazy probe — call it before the first network use; it
 * touches the filesystem only if the env var was unset.
 */
export declare class AuthProvider {
    private key;
    private keySource;
    constructor(apiKey?: string);
    /**
     * Ensure a key is available. Falls back to `~/.qodo/auth.key` if neither
     * explicit nor env-provided. Throws `QodoAuthError` on failure.
     */
    validate(): void;
    /** Resolved bearer + provenance. Call `validate()` first; this returns `''` if the key isn't loaded. */
    getAuthConfig(): AuthConfig;
    /**
     * Throw a `QodoAuthError` whose message names the auth source — useful when
     * an HTTP/WS round-trip returns 401 and the caller wants the user to fix
     * the right place.
     */
    handle401Error(): never;
}
//# sourceMappingURL=index.d.ts.map