export declare const AUTH_HELP = "usage: gws-axi auth <subcommand> [flags]\nsubcommands[9]:\n  setup     Progressive agent-guided OAuth setup (run repeatedly until complete)\n  join      Onboard onto a shared OAuth client from a downloaded credentials.json\n            (marks setup steps 1-6 done \u2014 for reusing a colleague's client)\n  login     Authenticate or re-auth an account (prepares + blocks on callback by default)\n  publish   Walk through publishing the consent screen to \"In Production\"\n            (lifts the 7-day Testing-state refresh-token expiry)\n  accounts  List authenticated accounts\n  use       Set the default account: gws-axi auth use <email>\n  revoke    Delete an account's tokens: gws-axi auth revoke <email>\n  status    Terse one-line status\n  reset     Clear setup state, optionally from a specific step\nsetup flags[6]:\n  --project <id>              Use existing GCP project (step 1)\n  --create-project <id>       Create new GCP project (step 1, needs gcloud)\n  --project-name <name>       Display name when creating (step 1)\n  --credentials-json <path>   Path to downloaded OAuth client JSON (step 4)\n  --test-user <email>         Record test user email (step 6 metadata)\n  --confirm-step <step>       Mark a manual step done (consent_screen, test_user_added)\njoin flags[1]:\n  --published                 Assert the shared client's consent screen is\n                              already published to Production (opt-in \u2014 join\n                              can't detect it; sets the local published flag so\n                              login/publish reporting reflects permanent tokens)\nlogin flags[3]:\n  --account <email>           Authenticate or re-auth a specific account. Omit\n                              only when 0 or 1 accounts exist (1 \u2192 re-auths it);\n                              with 2+ authenticated, --account is REQUIRED so the\n                              setup page + Google login_hint name the target.\n  --no-wait                   Prepare only and return fast (for agent flows\n                              that want to relay instructions to the user\n                              before binding the callback server). Pair\n                              with a follow-up `auth login --wait`.\n  --wait                      Block on the callback for a previously\n                              prepared session (paired with --no-wait).\npublish flags[1]:\n  --confirm                   Mark the consent screen as published in\n                              setup state (after clicking \"PUBLISH APP\"\n                              in the Console).\nreset flags[1]:\n  --from <step>               Clear from this step forward\nexamples:\n  gws-axi auth setup\n  gws-axi auth setup --create-project gws-axi-chris-9f3a\n  gws-axi auth setup --credentials-json ~/Downloads/client_secret_xxx.json\n  gws-axi auth join ~/Downloads/credentials.json          # reuse a shared client\n  gws-axi auth join ~/Downloads/credentials.json --published\n  gws-axi auth login --account chris@personal.com           # prepares + blocks (default)\n  gws-axi auth login --account chris@personal.com --no-wait # agent prepare-only\n  gws-axi auth login --wait                                 # agent block-only\n  gws-axi auth publish                                      # show publish walkthrough\n  gws-axi auth publish --confirm                            # mark consent screen as published\n  gws-axi auth accounts\n  gws-axi auth use chris@jarv.us\n  gws-axi auth revoke chris@personal.com\nflow:\n  Humans: `gws-axi auth login --account <email>` is one command that\n  prepares, prints a brief instruction, and waits for the OAuth\n  callback (up to 5 min).\n  Agents: pass --no-wait so the prepare returns immediately, relay the\n  instructions to the user, then call `gws-axi auth login --wait` in\n  a SEPARATE bash turn \u2014 the wait command binds the callback server\n  and must be listening before the user clicks.\n";
/**
 * Resolve the account an `auth login` targets. The resolved account drives both
 * the setup.html "authenticate as <email>" prompt AND the Google `login_hint`
 * (which pre-selects the account at the consent screen) — so without it the user
 * can't tell which browser profile/session to be in, and Google shows a bare
 * account chooser.
 *
 *   explicit --account → passes through unchanged.
 *   no --account, 0 accounts → first sign-in; undefined (Google shows chooser).
 *   no --account, 1 account  → re-auth it (a mismatch is still caught later).
 *   no --account, 2+ accounts → ambiguous; ACCOUNT_REQUIRED (must name which).
 */
export declare function resolveLoginAccount(account: string | undefined, existing: string[]): string | undefined;
export declare function authCommand(args: string[]): Promise<string | Record<string, unknown>>;