/**
 * CLI Authentication
 *
 * Handles storing and retrieving auth tokens for the CLI.
 * Tokens are stored in ~/.quickback/credentials.json
 *
 * The CLI uses Device Authorization flow which creates a real Better Auth session.
 * The CLI stores a bearer-safe signed token returned by /cli/exchange,
 * while the underlying Better Auth session is still stored server-side, so:
 * - It appears in the Manage Devices page
 * - Users can revoke CLI sessions from the UI
 * - The session can be scoped to an organization
 */
interface Credentials {
    token: string;
    expiresAt?: string;
    user?: {
        id: string;
        email: string;
        name?: string;
    };
    organization?: {
        id: string;
        name: string;
        slug: string;
    };
}
/**
 * Get stored CLI bearer token from credentials file.
 * Returns the bearer-safe signed CLI token from `quickback login`.
 * API keys (QUICKBACK_API_KEY env var) are handled separately in api-client.ts.
 */
export declare function getStoredToken(): Promise<string | null>;
/**
 * Store auth credentials
 */
export declare function storeCredentials(credentials: Credentials): Promise<void>;
/**
 * Clear stored credentials
 */
export declare function clearCredentials(): Promise<void>;
/**
 * Get stored user info
 */
export declare function getStoredUser(): Promise<Credentials['user'] | null>;
/**
 * Check if user is logged in
 */
export declare function isLoggedIn(): Promise<boolean>;
/**
 * Pre-compile auth gate.
 *
 * Returns the session token if the user is already logged in (or if
 * QUICKBACK_API_KEY is set — the API key path doesn't use a session).
 * Otherwise prompts (sign-in / sign-up / cancel) and runs the device
 * flow. Returns `null` if the user cancels — the caller decides whether
 * to abort or leave artifacts on disk.
 *
 * Local compiler URLs skip the gate entirely so `bash dev.sh` workflows
 * don't need a real session.
 *
 * Extracted from compile.ts so `create` / `start` can defer auth until
 * *after* they've scaffolded files — the user sees real progress before
 * being asked to sign in, and a Ctrl-C at the prompt leaves a usable
 * scaffold on disk.
 */
export interface EnsureAuthOptions {
    /** Compiler URL — used to detect localhost and bypass the prompt. */
    apiUrl: string;
    /** Called with the device flow's login function to avoid a circular import. */
    loginFn: () => Promise<void>;
    /** Optional caption shown before the prompt — defaults to a generic line. */
    reason?: string;
}
export type EnsureAuthResult = {
    status: 'authenticated';
    token: string;
    via: 'api-key' | 'session';
} | {
    status: 'local-no-auth';
} | {
    status: 'cancelled';
};
/**
 * Only loopback hostnames used by the supported local Docker launcher bypass
 * the CLI login prompt. URL text elsewhere (path, query, userinfo, or a longer
 * hostname such as localhost.example.com) must never be treated as local.
 */
export declare function isLocalCompilerUrl(apiUrl: string): boolean;
export declare function ensureAuthForCompile(options: EnsureAuthOptions): Promise<EnsureAuthResult>;
export {};
//# sourceMappingURL=auth.d.ts.map