/**
 * Cognito-based authentication for create-hq.
 *
 * Uses the shared OSS `@indigoai-us/hq-cloud` helper to drive Cognito Hosted UI
 * through a PKCE + loopback OAuth flow. Forces Google as the identity provider
 * so the experience matches hq-installer (the Tauri desktop app) and the rest
 * of the HQ by Indigo suite.
 *
 * Token cache: `~/.hq/cognito-tokens.json` — canonical shared session file used
 * by hq-cloud, hq-cli, hq-installer, and the deploy skill. All four agree on
 * this path, so any of them can refresh or invalidate the session.
 *
 * Exports follow the pattern in hq-cli's `utils/cognito-session.ts`:
 *   - DEFAULT_COGNITO  — config matching hq-installer's .env.local
 *   - ensureCognitoToken({ interactive }) — top-level helper used by the
 *     teams flow. Returns `CognitoTokens` or null if sign-in failed.
 *   - readIdentity(tokens) — decodes the ID token payload (email, name).
 */
import { type CognitoAuthConfig, type CognitoTokens } from "@indigoai-us/hq-cloud";
/**
 * Default Cognito pool for HQ by Indigo. Mirrors hq-installer's `.env.local`
 * and hq-cli's `DEFAULT_COGNITO`. All three tools share the same pool so a
 * single sign-in works across installer, CLI, and create-hq.
 *
 * Defaults point at the shared `vault-indigo-hq-prod` Cognito pool (canonical
 * post-2026-04-25 cutover). The legacy `hq-vault-dev` pool is no longer the
 * fallback — it remains reachable only via explicit `HQ_COGNITO_DOMAIN` env
 * override for staging tests. Mirrors `packages/hq-cli/src/utils/cognito-session.ts`
 * and `packages/hq-cloud/src/bin/sync-runner.ts` so all three callers stay
 * drift-free.
 *
 * Port 8765 matches hq-cli (not hq-installer's 53682) — Cognito App Client
 * callback URLs must list every port we use, and we're standardizing on 8765
 * for all Node-based callers.
 */
export declare const DEFAULT_COGNITO: CognitoAuthConfig;
export interface HqIdentity {
    /** Cognito `sub` — stable user ID. */
    sub: string;
    email?: string;
    name?: string;
    /** Raw decoded JWT payload, for callers that need extra claims. */
    claims: Record<string, unknown>;
}
/**
 * Return a valid set of Cognito tokens, refreshing or launching the browser
 * flow as needed. Returns null when interactive login fails (user closed the
 * tab, timeout, network error) — caller should treat that as "user declined".
 *
 * When `interactive: false`, this function will never open a browser — it
 * returns null if no valid cached token is available. Useful for CI / non-TTY
 * environments where we want a hard fail instead of a hung browser prompt.
 */
export declare function ensureCognitoToken(opts?: {
    interactive?: boolean;
    config?: CognitoAuthConfig;
}): Promise<CognitoTokens | null>;
/**
 * Decode the ID token payload. No signature verification — we only read
 * display fields (email, name) for the UI. Never trust these claims for
 * authorization; the server re-verifies the JWT on every API call.
 */
export declare function readIdentity(tokens: CognitoTokens): HqIdentity | null;
/** Delete the cached Cognito session. */
export declare function signOut(): void;
export type { CognitoAuthConfig, CognitoTokens };
//# sourceMappingURL=auth.d.ts.map