export interface HarnessIdentity {
    userId: string;
    tenantId: string;
    organizationName: string;
    apiKey: string;
    /** "cached" when resolved from ~/.sapiom/credentials.json with no login
     *  prompt this run; "fresh" right after a browser login just completed.
     *  Lets the CLI make a silent cached-credential sign-in visible. */
    source: "cached" | "fresh";
}
export interface EnsureAuthenticatedOptions {
    /** Prompt a browser login when no cached credential exists. */
    interactive: boolean;
    /** Skip auth entirely (the `--no-auth` flag) — no fs/network access. */
    noAuth?: boolean;
    /** Overrides SAPIOM_ENVIRONMENT for this call. */
    environment?: string;
}
/**
 * Reuses `@sapiom/mcp`'s browser OAuth flow and `~/.sapiom/credentials.json`
 * cache so the harness and the sapiom-dev MCP share one identity. Returns
 * `null` when `noAuth` is set, or when not interactive and no credential is
 * cached yet.
 */
export declare function ensureAuthenticated(options: EnsureAuthenticatedOptions): Promise<HarnessIdentity | null>;
//# sourceMappingURL=auth.d.ts.map