interface UserProfile {
    email: string;
    organization_id: string;
    role: string;
    plan: string;
}
interface CLIConfigData {
    version?: string;
    apiUrl?: string;
    token?: string | undefined;
    user?: UserProfile | undefined;
    lastUpdated?: string;
    mcpServerPath?: string;
    mcpServerUrl?: string;
    mcpUseRemote?: boolean;
    mcpPreference?: 'local' | 'remote' | 'websocket' | 'auto';
    discoveredServices?: {
        auth_base: string;
        memory_base: string;
        mcp_base?: string;
        mcp_ws_base: string;
        mcp_sse_base?: string;
        project_scope: string;
    };
    lastServiceDiscovery?: string;
    manualEndpointOverrides?: boolean;
    lastManualEndpointUpdate?: string;
    vendorKey?: string | undefined;
    authMethod?: 'jwt' | 'vendor_key' | 'oauth' | 'oauth2' | undefined;
    refresh_token?: string | undefined;
    token_expires_at?: number | string | undefined;
    tokenExpiry?: number | undefined;
    lastValidated?: string | undefined;
    deviceId?: string;
    authFailureCount?: number;
    lastAuthFailure?: string | undefined;
    [key: string]: unknown;
}
export type RemoteAuthVerification = {
    valid: boolean;
    method: 'token' | 'vendor_key' | 'none';
    endpoint?: string;
    reason?: string;
};
export declare class CLIConfig {
    private configDir;
    private configPath;
    private config;
    private lockFile;
    private static readonly CONFIG_VERSION;
    private authCheckCache;
    private readonly AUTH_CACHE_TTL;
    private apiKeyStorage?;
    private vendorKeyCache?;
    private isLegacyHashedCredential;
    private getLegacyHashedVendorKeyReason;
    private normalizeOptionalString;
    private extractOrganizationId;
    private buildUserProfile;
    constructor();
    private getApiKeyStorage;
    /**
     * Overrides the configuration storage directory. Primarily used for tests.
     */
    setConfigDirectory(configDir: string): void;
    /**
     * Exposes the current config path for tests and diagnostics.
     */
    getConfigPath(): string;
    init(): Promise<void>;
    load(): Promise<void>;
    private migrateConfigIfNeeded;
    save(): Promise<void>;
    atomicSave(): Promise<void>;
    backupConfig(): Promise<string>;
    private acquireLock;
    private releaseLock;
    getApiUrl(): string;
    getApiUrlsWithFallbacks(): string[];
    discoverServices(verbose?: boolean): Promise<void>;
    private normalizeServiceError;
    private handleServiceDiscoveryFailure;
    private categorizeServiceDiscoveryError;
    private resolveFallbackEndpoints;
    private logFallbackUsage;
    private pingAuthHealth;
    private getAuthVerificationEndpoints;
    private extractAuthErrorMessage;
    private verifyTokenWithAuthGateway;
    private verifyVendorKeyWithAuthGateway;
    verifyCurrentCredentialsWithServer(): Promise<RemoteAuthVerification>;
    setManualEndpoints(endpoints: Partial<CLIConfigData['discoveredServices']>): Promise<void>;
    hasManualEndpointOverrides(): boolean;
    /**
     * Clears the in-memory auth cache so that the next `isAuthenticated()` call
     * performs a fresh server verification rather than returning a stale cached result.
     *
     * NOTE: `lastValidated` is intentionally NOT deleted here. Each auth path
     * (vendor_key, token) already correctly rejects 401 responses without relying
     * on `lastValidated`. Deleting it would destroy the offline grace period
     * (7-day for vendor keys, 24-hour for JWT tokens), causing auth failures
     * on transient network errors even when credentials are valid.
     */
    invalidateAuthCache(): Promise<void>;
    clearManualEndpointOverrides(): Promise<void>;
    getDiscoveredApiUrl(): string;
    setVendorKey(vendorKey: string, options?: {
        skipServerValidation?: boolean;
    }): Promise<void>;
    validateVendorKeyFormat(vendorKey: string): string | boolean;
    private validateVendorKeyWithServer;
    getVendorKey(): string | undefined;
    /**
     * Synchronous wrapper for async retrieve operation
     * Note: ApiKeyStorage.retrieve() is async but we need sync for existing code
     */
    private getVendorKeySync;
    /**
     * Async method to get vendor key from secure storage
     */
    getVendorKeyAsync(): Promise<string | undefined>;
    hasVendorKey(): boolean;
    setApiUrl(url: string): Promise<void>;
    setToken(token: string): Promise<void>;
    getToken(): string | undefined;
    getAuthMethod(): string | undefined;
    getCurrentUser(): Promise<UserProfile | undefined>;
    updateCurrentUserProfile(profile: Record<string, unknown>): Promise<void>;
    isAuthenticated(): Promise<boolean>;
    logout(): Promise<void>;
    clear(): Promise<void>;
    exists(): Promise<boolean>;
    validateStoredCredentials(): Promise<boolean>;
    refreshTokenIfNeeded(): Promise<void>;
    private refreshViaOAuthTokenEndpoint;
    clearInvalidCredentials(): Promise<void>;
    incrementFailureCount(): Promise<void>;
    resetFailureCount(): Promise<void>;
    getFailureCount(): number;
    getLastAuthFailure(): string | undefined;
    shouldDelayAuth(): boolean;
    getAuthDelayMs(): number;
    getDeviceId(): Promise<string>;
    get<T = unknown>(key: string): T;
    set(key: string, value: unknown): void;
    setAndSave(key: string, value: unknown): Promise<void>;
    getMCPServerPath(): string;
    getMCPServerUrl(): string;
    getMCPRestUrl(): string;
    getMCPSSEUrl(): string;
    shouldUseRemoteMCP(): boolean;
}
export {};