/**
 * The CLI's stored credentials. A service token is a machine credential (the same
 * `SERVICE_TOKEN` the control plane holds); it resolves to the platform's service
 * actor. Kept in `~/.substrat/config.json`, chmod 600 — a home-dir file, never in a
 * repo. A push reads it so you authenticate once with `substrat login`, not per call.
 */
export interface CliConfig {
    controlPlaneUrl?: string;
    /** A browser-login session (sent as `Authorization: Bearer`) — per-human, from `substrat login`. */
    bearerToken?: string;
    /** A shared machine credential (sent as `x-service-token`) — for CI, from `substrat login --token`. */
    serviceToken?: string;
    /**
     * The tenant a builder acts for (builder-plane.md §5) — the id or slug the control plane
     * prefixes onto a bare `--slug` to form `<tenantSlug>/<name>`. Stored by `substrat login`
     * (the sole/selected workspace); `--tenant` overrides per command. Sent as
     * `x-substrat-tenant` with every auth kind: a browser session becomes a builder narrowed
     * to it, and a service token keeps its staff reach but the control plane uses it to
     * resolve a bare slug to the workspace's `<tenantSlug>/<name>` registry id (#417).
     *
     * `push` deliberately does NOT fall back to this (`useDefaultTenant: false`): which
     * workspace owns a vertical is a property of the project (package.json `substrat.tenant`),
     * and a silently-wrong machine-wide default would claim `<wrong-tenant>/<slug>` on first
     * push. For push this is only the pre-filled suggestion in the interactive picker.
     */
    defaultTenant?: string;
}
export declare function loadConfig(): CliConfig;
/** Write the config 0600 (best-effort chmod — a no-op on platforms without it). */
export declare function saveConfig(cfg: CliConfig): string;
export interface ResolvedAuth {
    controlPlaneUrl: string;
    /** The auth header to send with an authenticated request. */
    header: Record<string, string>;
    /** Human description of how we authenticated (for the CLI to print). */
    as: string;
    /** 'session' = a per-human browser login (tenant-scoped); 'service' = the platform actor. */
    kind: 'session' | 'service';
}
/**
 * Resolve the control-plane URL + the auth header, in precedence order:
 *   URL:   flag → SUBSTRAT_CP_URL → config
 *   auth:  explicit service token (flag/env, for CI) → stored browser session → stored service token
 * A browser session is sent as `Authorization: Bearer` (per-human, roster-gated); a
 * service token as `x-service-token` (the platform service actor). Throws a clear,
 * actionable error pointing at `substrat login` rather than surfacing a 401 later.
 */
export declare function resolveAuth(flags: {
    cp?: string;
    token?: string;
    tenant?: string;
    /** false = never fall back to the stored defaultTenant (push — the project decides). */
    useDefaultTenant?: boolean;
}): ResolvedAuth;
//# sourceMappingURL=config.d.ts.map