import { execFileSync } from 'child_process';
export interface ClaudeOAuthCredentials {
    accessToken: string;
    refreshToken?: string;
    expiresAt?: number;
    scopes?: string[];
    subscriptionType?: string;
}
/** Injection seam for tests. Production uses real subprocess/fs/clock. */
export interface ClaudeOAuthDeps {
    exec: typeof execFileSync;
    now: () => number;
    readFile: (path: string) => string;
    /** Atomic, 0600 write (temp file + rename). */
    writeFile: (path: string, data: string) => void;
    homedir: () => string;
    /** Diagnostic sink for the refresh attempt/outcome (default: stderr). */
    log: (msg: string) => void;
}
/**
 * Claude Code subscription token retrieval (4.2.3+), cross-platform.
 *
 * Reads Claude Code's OAuth credentials — from the macOS Keychain on darwin,
 * or `~/.claude/.credentials.json` on Linux/other — as the JSON blob
 * `{"claudeAiOauth": {"accessToken", "refreshToken", "expiresAt", ...}}`.
 *
 * When `expiresAt` is in the past (or within `EXPIRY_SKEW_MS`), the stored
 * refresh token is exchanged for a new access token, the new credentials are
 * written back to the same store, and the fresh credentials are returned.
 *
 * Returns null when:
 *   - The store has no entry (user never logged in to Claude Code)
 *   - The stored value isn't valid JSON or is missing the access token
 *   - The token is expired AND there is no refresh token, or the refresh
 *     request fails (caller should fall back to env var or config apiKey)
 */
export declare function getClaudeOAuth(overrides?: Partial<ClaudeOAuthDeps>): ClaudeOAuthCredentials | null;
//# sourceMappingURL=claude-oauth.d.ts.map