/** Resolved auth targets — every field has a prod default, all env-overridable. */
export interface StoreAuthConfig {
    keycloakUrl: string;
    realm: string;
    clientId: string;
    authFile: string;
}
/**
 * Load the auth config. Defaults target the production store
 * (`auth.skaile.ai`, realm `skaile-store`, public client `skaile-store-cli`);
 * override with `SKAILE_KEYCLOAK_URL` / `SKAILE_STORE_REALM` /
 * `SKAILE_STORE_CLI_CLIENT` / `SKAILE_AUTH_FILE` for dev or a preview deploy.
 */
export declare function loadStoreAuthConfig(): StoreAuthConfig;
export interface StoredAuth {
    access_token: string;
    refresh_token?: string;
    /** Epoch ms when the access token expires (with a safety margin already applied). */
    expires_at: number;
}
/** Injectable seams so the poll loop is unit-testable without real time or network. */
export interface AuthDeps {
    fetchImpl?: typeof fetch;
    sleep?: (ms: number) => Promise<void>;
    /** Called once with the verification URL + user code (default: write to stderr). */
    onPrompt?: (url: string, userCode: string) => void;
}
/**
 * The caller's store identity, decoded LOCALLY from the cached token's JWT
 * payload (no network, no signature check — this is an author-side hint, not an
 * authorization decision). Returns `null` when not signed in or the token is
 * unreadable. `githubLogin` is the verified GitHub handle (the preferred
 * publisher namespace); `username` is the Keycloak `preferred_username`.
 */
export declare function getStoreIdentity(config?: StoreAuthConfig): {
    username?: string;
    githubLogin?: string;
} | null;
/** Remove the cached session (sign out). */
export declare function logout(config: StoreAuthConfig): void;
/** True when a cached, well-formed session exists (validity/refresh resolved on use). */
export declare function hasStoredAuth(config: StoreAuthConfig): boolean;
/**
 * Run the device flow to completion, persisting tokens on success. Prints the
 * verification URL + user code for the operator to approve in a browser.
 */
export declare function deviceLogin(config: StoreAuthConfig, deps?: AuthDeps): Promise<StoredAuth>;
/**
 * Return a valid access token, refreshing if it is expired (or about to). Throws
 * a clear "run `skaile store login`" error when there is no usable session.
 */
export declare function getAccessToken(config: StoreAuthConfig, deps?: AuthDeps): Promise<string>;
//# sourceMappingURL=store-auth.d.ts.map