import type { AuthSourceReport, ProviderOptions } from "../types.js";
/**
 * The Cursor CLI (`cursor-agent`) keeps sign-in identity in a plain
 * `cli-config.json` and the tokens themselves in the macOS login Keychain, or
 * in `auth.json` on Linux, unlike the Cursor editor which keeps both in its
 * `state.vscdb`. This module reads only the access token. The macOS Keychain
 * path uses the same `--allow-keychain-prompt` gate as the Claude keychain
 * source; the Linux auth file is read directly without any refresh behavior.
 *
 * Access-token refresh is intentionally not implemented: neither the Linux
 * `refreshToken` field nor the macOS `cursor-refresh-token` item is read,
 * because no safe vendor-owned non-interactive refresh command has been
 * established for Cursor. A rejected access token can therefore use an
 * eligible stale snapshot or report that authentication is required; recovery
 * is running `cursor-agent login` again.
 */
export declare const CURSOR_CLI_SOURCE = "cli-keychain";
export declare const CURSOR_CLI_AUTHFILE_SOURCE = "cli-authfile";
export declare const CURSOR_CLI_KEYCHAIN_SERVICE = "cursor-access-token";
export declare const CURSOR_CLI_KEYCHAIN_ACCOUNT = "cursor-user";
export type CursorCliIdentity = {
    email?: string;
    userId?: string;
};
export type CursorCliCredentialState = {
    status: "available";
    accessToken: string;
    identity: CursorCliIdentity;
    source: AuthSourceReport;
} | {
    status: "missing" | "invalid" | "skipped";
    source: AuthSourceReport;
};
type IdentityResult = {
    status: "present";
    identity: CursorCliIdentity;
} | {
    status: "missing";
} | {
    status: "invalid";
    error: string;
};
/** The Cursor CLI token store is the macOS Keychain or Linux auth file. */
export declare function isCursorCliSourceSupported(): boolean;
export declare function cursorCliConfigPath(): string;
export declare function cursorCliAuthFilePath(): string;
export declare function readCursorCliCredentialState(options: ProviderOptions, presenceOnly?: boolean): Promise<CursorCliCredentialState>;
/** Identity only: `cli-config.json` never holds a token. */
export declare function readCursorCliIdentity(path: string): IdentityResult;
export {};