/**
 * Provider-side GitHub Copilot auth resolution over the same credential record
 * that DSH's built-in llm-pi-ai adapter owns.
 */
import type { Context } from '@deepseek-ai/cordis';
import { type CredentialStore, type OAuthAuth } from '@earendil-works/pi-ai';
import { GITHUB_COPILOT_PROVIDER_ID, GITHUB_COPILOT_PREVIEW_PROVIDER_ID } from './copilot-identity.ts';
import type { GitHubCopilotOAuthCredential } from './copilot-grant.ts';
import type { CopilotAccountBinding } from './copilot-accounts-types.ts';
export { normalizeGitHubCopilotOAuthCredential } from './copilot-grant.ts';
/** Only a validated native OAuth refresh may certify its exact returned object. */
export declare function certifyCopilotNativeRefresh(previous: GitHubCopilotOAuthCredential, result: GitHubCopilotOAuthCredential, derive: OAuthAuth['toAuth'], signal?: AbortSignal): Promise<void>;
/** Consume exactly one notification from the serialized, certified write. */
export declare function observeCopilotNativeRefresh(ctx: Context, key: string): Promise<boolean> | undefined;
export declare function captureActiveGitHubCopilotBinding(ctx: Context): CopilotAccountBinding | undefined;
/** Bind exactly one logical route to the canonical Host-owned credential record. */
export declare function createGitHubCopilotCredentialStore(ctx: Context, logicalProviderId?: typeof GITHUB_COPILOT_PROVIDER_ID | typeof GITHUB_COPILOT_PREVIEW_PROVIDER_ID, binding?: CopilotAccountBinding): CredentialStore;
/**
 * Build one resolver whose pi-ai collection refreshes OAuth credentials inside
 * the DSH record's serialized modify operation before exposing request auth.
 */
export declare function createGitHubCopilotTokenResolver(ctx: Context, onCredentialChanged?: () => Promise<void>): (modelId: string) => Promise<GitHubCopilotRequestAuth | undefined>;
export interface GitHubCopilotRequestAuth {
    readonly apiKey: string;
    readonly baseURL: string;
    readonly headers?: Readonly<Record<string, string | null>>;
}
/** Validate an OAuth-derived endpoint without disclosing its value or credential payload. */
export declare function trustedGitHubCopilotBaseUrl(value: string | undefined, grant: unknown): string;
//# sourceMappingURL=copilot-auth.d.ts.map