import { type Keychain } from "../lib/keychain.js";
export interface AuthCommandIO {
    stdout: {
        write: (s: string) => boolean;
    };
    stderr: {
        write: (s: string) => boolean;
    };
    exit?: (code: number) => void;
    /** Optional browser opener; if absent, login skips the auto-open step. */
    openBrowser?: (url: string) => Promise<void>;
}
export interface AuthCommandDeps {
    io: AuthCommandIO;
    keychain?: Keychain;
    fetchImpl?: typeof fetch;
    sleep?: (ms: number) => Promise<void>;
    /** OAuth client_id; defaults to env VSKILL_GITHUB_CLIENT_ID. */
    clientId?: string;
    /** vskill version for User-Agent stamping. */
    version?: string;
    /**
     * 0839 US-005 — exchange a `gho_*` token for a `vsk_*` token via the
     * platform `/auth/github/exchange-for-vsk-token` endpoint. Optional so
     * tests can inject a fake; production wires `exchangeForVskToken` from
     * `../api/client.ts`. Failure of this call MUST NOT block login
     * (AC-US5-05 — fall back to "legacy mode").
     */
    exchangeForVskToken?: (githubToken: string) => Promise<{
        token: string;
    }>;
    /**
     * 0839 US-005 / AC-US5-06 — best-effort server-side revocation invoked
     * on logout. Failure MUST NOT block local logout. Defaults to the
     * platform `signOutAll` helper from `../api/client.ts`.
     */
    signOutAll?: () => Promise<void>;
    /**
     * 0839 F-004 — invalidate the in-memory auth cache after keychain
     * mutations so a same-process `auth login && orgs list` sees the fresh
     * token. Optional so tests can inject a spy; production wires
     * `invalidateAuthCache` from `../api/client.ts`.
     */
    invalidateAuthCache?: () => void;
}
export declare function authCommand(argv: string[], deps: AuthCommandDeps): Promise<number>;