import type { CliConfig } from '../lib/config.js';
import type { OneCredentials } from './types.js';
export declare function boundIdentityCredentials(config: CliConfig, one: OneCredentials): boolean;
/** Library callers may omit or mistype timeoutMs; NaN would make the wait unbounded. */
export declare function credentialsLockWaitMs(timeoutMs: unknown): number;
/** Another command holds credentials.json.lock. */
export declare class CredentialsLockedError extends Error {
    constructor();
}
/**
 * credentials.json.lock guards both credentials files; CLI 0.2.0 takes the same lock.
 * Never steal a stale lock: a crashed refresh may have consumed the rotating token.
 * With `wait` false, a held lock fails at once instead of after the lock wait.
 */
export declare function withCredentialsLock<T>(config: Pick<CliConfig, 'configDir'> & Partial<Pick<CliConfig, 'timeoutMs'>>, callback: () => Promise<T>, replaceDeadLock?: boolean, wait?: boolean): Promise<T>;
export declare function managedAccessToken(config: CliConfig, failedToken?: string): Promise<string | null>;
/**
 * Revoke one saved refresh grant. Identity answers 400 (`invalid_request` or `invalid_grant`) for a token it no
 * longer knows or has already revoked, for example after a browser sign-out ended the session that approved it,
 * or a refresh rotated it; nothing is left to revoke then. Other failures throw.
 */
export declare function revokeIdentityGrant(config: CliConfig, one: OneCredentials): Promise<void>;
/**
 * Revoke every saved Identity grant, then remove its file. A failed revocation keeps every file. A safe file that
 * can't be parsed has no grant to revoke; the login that calls this replaces it. Callers hold the lock.
 */
export declare function revokeIdentityCredentials(config: CliConfig): Promise<boolean>;
/** Revoke and remove every credentials file. A failed Identity revocation keeps them all. */
export declare function revokeSavedCredentials(config: CliConfig, onWarning?: (message: string) => void): Promise<boolean>;