specrails-core 5.2.3 → 5.4.0

package/dist/installer/commands/init.d.ts

@@ -0,0 +1,147 @@
+import { type Provider } from '../phases/install-config.js';
+/**
+ * `npx specrails-core init` entry point.
+ *
+ * Flags consumed (must remain in sync with ALLOWED_FLAGS in
+ * bin/specrails-core.cjs until Phase 5):
+ *   --root-dir <path>     Target repo (default: cwd)
+ *   --yes / -y            Non-interactive; auto-init git + accept defaults
+ *   --provider <name>     Force provider (claude, codex, gemini, or kimi)
+ *   --from-config [<p>]   Read provider + agents from install-config.yaml
+ *   --relocate            Relocate artifacts to the $HOME workspace (symlinked
+ *                         from the bundled framework) instead of installing them
+ *                         IN-REPO. Default is in-repo so a standalone user's
+ *                         `claude`/`codex`/`gemini`/`kimi` finds its artifacts in
+ *                         their own repo. specrails-desktop pre-creates a registry
+ *                         entry (so it always relocates regardless of this flag);
+ *                         standalone users opt in with `--relocate` or
+ *                         `SPECRAILS_RELOCATE=1`.
+ */
+export interface InitFlags {
+    'root-dir'?: string | boolean;
+    yes?: boolean;
+    y?: boolean;
+    provider?: string | boolean;
+    'from-config'?: string | boolean;
+    relocate?: boolean;
+    'hub-json'?: boolean;
+}
+export interface InitResult {
+    repoRoot: string;
+    provider: Provider;
+}
+export type WorkspaceProviderSelections = Partial<Record<Provider, string[]>>;
+/**
+ * Snapshot the provider/role inventory exposed by one live workspace before a
+ * global framework version swap. This matters on Windows: directory junctions
+ * resolve their target when they are created, so a workspace link made through
+ * `framework/current` must be recreated after `current` moves. Keeping the
+ * exact visible `sr-*` set also avoids widening or narrowing a project's
+ * optional role selection during that refresh.
+ */
+export declare function snapshotWorkspaceProviderSelections(workspace: string): WorkspaceProviderSelections;
+interface ReassembleWorkspaceProvidersInput {
+    workspace: string;
+    frameworkDir: string;
+    version: string;
+    codeRoot: string;
+    scriptDir: string;
+    selectedProvider: Provider;
+    selectedAgents?: string[];
+    previousSelections: WorkspaceProviderSelections;
+    copyStatics: boolean;
+}
+/**
+ * Refresh every provider already represented in the project plus the provider
+ * selected by the current operation. POSIX symlinks continue to follow
+ * `framework/current`; Windows junctions do not reliably preserve that
+ * indirection, so rebuilding all live links is required for true
+ * multi-provider version parity.
+ */
+export declare function reassembleWorkspaceProviders(input: ReassembleWorkspaceProvidersInput): Provider[];
+/**
+ * Entry called by cli.ts. Returns a {@link InitResult} on success;
+ * throws a typed error (translated to an exit code by the outer CLI)
+ * on failure.
+ */
+export declare function runInit(flags: InitFlags): Promise<InitResult>;
+/**
+ * Warn (once per id) about `agents.selected` entries that have no shipped
+ * template — typically a pre-v5 install-config.yaml still listing removed
+ * agents. They are skipped at placement; the warning tells the user why and
+ * points at the v5 extension path.
+ */
+export declare function warnUnknownSelectedAgents(selected: string[] | undefined): void;
+export interface EnsureFrameworkInput {
+    scriptDir: string;
+    frameworkDir: string;
+    provider: Provider;
+    providerDir: string;
+    version: string;
+    selectedAgents?: string[];
+    /**
+     * Additional providers that must remain available through the global
+     * `framework/current` pointer after this version transition.
+     */
+    requiredProviders?: Provider[];
+    /** Registry home override used while computing the global provider union. */
+    registryHome?: string;
+    /**
+     * When false, MATERIALIZE the provider subtree but do NOT swap
+     * `<frameworkDir>/current` to point at `<version>`. The caller is responsible
+     * for the single `ensureCurrentSymlink(frameworkDir, version)` swap AFTER all
+     * providers have been materialized. This prevents a multi-provider install
+     * from leaving `current` pointed at a version dir that is missing a provider
+     * whose materialization later failed. Defaults to true (swap — the standalone
+     * single-provider `init` path is byte-identical to before).
+     */
+    swapCurrent?: boolean;
+}
+/**
+ * Materialize the framework for `(version, provider)` if absent and (by default)
+ * point `<frameworkDir>/current` at that version. Idempotent — `installFramework`
+ * skips re-materialization when the providerDir already exists with a matching
+ * stamp, so a second project (or a repeat init) reuses the SAME framework copy.
+ * Shared by `runInit` and `runUpdate`.
+ *
+ * Pass `swapCurrent: false` to materialize WITHOUT swapping `current` — the
+ * multi-provider "materialize-all-then-swap-once" pattern desktop consumes:
+ *   for (const p of providers) ensureFramework({ ..., provider: p, swapCurrent: false })
+ *   ensureCurrentSymlink(frameworkDir, version) // single atomic swap at the end
+ */
+export declare function ensureFramework(input: EnsureFrameworkInput): void;
+/**
+ * Resolve the `{bin, args}` to invoke `openspec init` for a project, honouring
+ * two optional env overrides (both default unset → `npx @fission-ai/openspec`):
+ *
+ *  - `SPECRAILS_OPENSPEC_BIN`  — path to the openspec CLI entry (a `.js` node
+ *    script when bundled by the desktop app, OR a real executable in tests).
+ *  - `SPECRAILS_OPENSPEC_NODE` — path to a node executable. Set ONLY by the
+ *    desktop bundled-offline path: Tauri strips exec bits from bundled
+ *    resources and the bundled openspec is a node CLI (not a runnable binary),
+ *    so it must be invoked as `node <cli> init …` rather than executed directly.
+ *
+ * Three invocation forms:
+ *  1. NODE + BIN set → `runCommand(node, [cli, 'init', '--tools', provider, repoRoot])`
+ *     (bundled offline — Tauri-stripped node CLI).
+ *  2. BIN set only   → `runCommand(cli, ['init', '--tools', provider, repoRoot])`
+ *     (a real executable: legacy override / test fake binary on PATH).
+ *  3. neither set    → `runCommand('npx', ['--yes', '-p', '@fission-ai/openspec@<pinned>', '--', 'openspec', 'init', …])`
+ *     (default online path — users never need a global install).
+ */
+export declare function buildOpenSpecInvocation(repoRoot: string, provider: Provider, env?: NodeJS.ProcessEnv, pinnedVersion?: string): {
+    bin: string;
+    args: string[];
+};
+export declare const KIMI_REQUIRED_OPENSPEC_SKILLS: readonly ["openspec-propose", "openspec-explore", "openspec-new-change", "openspec-continue-change", "openspec-apply-change", "openspec-ff-change", "openspec-sync-specs", "openspec-archive-change", "openspec-bulk-archive-change", "openspec-verify-change", "openspec-onboard"];
+/**
+ * Move only OpenSpec-owned Kimi workflow directories from either upstream
+ * location into the artifact workspace. Every destination is copied to a
+ * sibling temporary directory and renamed, so readers never observe a partial
+ * skill. A distinct newly generated source refreshes the managed destination;
+ * an in-place corrected destination is retained as-is.
+ */
+export declare function normalizeKimiOpenSpecSkills(repoRoot: string, artifactRoot: string): string[];
+export declare function normalizeGeminiOpenSpecSkills(repoRoot: string, artifactRoot: string): string[];
+export declare function installOpenSpecProject(repoRoot: string, provider: Provider, artifactRoot?: string): Promise<void>;
+export {};

package/dist/installer/commands/update.d.ts

@@ -0,0 +1,56 @@
+import { type Provider } from '../phases/provider-detect.js';
+/**
+ * Components recognised by the `--only <component>` flag. Mirrors the
+ * retired bash installer's accepted values plus an explicit map of
+ * what each one actually does in the Node port.
+ */
+export type OnlyComponent = 'all' | 'core' | 'rules' | 'agents' | 'web-manager';
+/**
+ * `npx specrails-core update` entry point.
+ *
+ * Re-runs the scaffolding layer so fresh templates overwrite the
+ * bundled commands and .specrails/setup-templates/ content. Reserved
+ * paths are respected by the shared isReservedPath gate inside
+ * fs utilities and scaffolding; the update never touches the user's
+ * profile JSON or custom-* agents.
+ *
+ * The retired update.sh computed a template-diff against the manifest
+ * and regenerated only changed files. We ship a simpler, stricter
+ * contract: always re-scaffold every specrails-managed artefact, then
+ * rewrite the manifest. The outcome is identical for the common case
+ * (upgrade bumps the core version → nearly every template changes)
+ * and is far easier to reason about than a bespoke diff algorithm.
+ */
+export interface UpdateFlags {
+    'root-dir'?: string | boolean;
+    only?: string | boolean;
+    'dry-run'?: boolean;
+    yes?: boolean;
+    /**
+     * Force the provider to update. Without it, the provider is auto-detected
+     * from the existing install (`.claude` > `.codex` > `.gemini` > `.kimi-code`), which on a
+     * MULTI-PROVIDER workspace always picks `.claude` first — so codex/gemini/kimi
+     * could never be updated. specrails-desktop (and standalone users) pass
+     * `--provider <name>` to update one specific provider. Mirrors `init`.
+     */
+    provider?: string | boolean;
+    /**
+     * Relocate artifacts to the $HOME workspace (symlinked) instead of in-repo.
+     * Mirrors `init --relocate`: standalone updates resolve in-repo by default,
+     * desktop relocates (its registry entry already exists, so `allocate:false`
+     * still resolves the relocated entry). Also honoured via `SPECRAILS_RELOCATE=1`.
+     */
+    relocate?: boolean;
+}
+export interface UpdateResult {
+    repoRoot: string;
+    previousVersion: string | null;
+    currentVersion: string;
+    provider: Provider;
+    dryRun: boolean;
+    /** Resolved scope of the update — what was actually re-applied. */
+    scope: OnlyComponent;
+    /** Framework version actually installed; partial updates retain the old version. */
+    installedVersion?: string | null;
+}
+export declare function runUpdate(flags: UpdateFlags): Promise<UpdateResult>;

package/dist/installer/commands/v5-migration.d.ts

@@ -0,0 +1,32 @@
+export interface V5MigrationInput {
+    /** Absolute artifact root (in-repo repoRoot, or the relocated $HOME workspace). */
+    artifactRoot: string;
+    /** Provider directory name (`.claude` / `.codex` / `.gemini`). */
+    providerDir: string;
+}
+/**
+ * Removes artefacts a pre-v5 install left behind so the fresh v5 template set
+ * places into a clean tree. Strictly subtractive and reserved-path-safe:
+ *
+ *   - Removed agent files (`.claude/agents/sr-*.md`, `.gemini/agents/sr-*.md`)
+ *   - Removed command files (`<providerDir>/commands/specrails/*.md`) and their
+ *     codex skill dirs (`.codex/skills/<cmd>/`)
+ *   - The generated top-level skills for removed commands (`.claude/skills/<id>/`)
+ *   - Obsolete staging subtrees under `.specrails/setup-templates/`
+ *     (`personas/`, `skills/enrich/`, and the removed command/agent templates)
+ *   - VPC persona output dirs (`<providerDir>/agents/personas/`)
+ *
+ * `custom-*.md` agents and `.specrails/profiles/**` are protected by
+ * {@link isReservedPath}; files the installer never owned are not enumerated
+ * here, so they are untouched. When at least one path is removed a migration
+ * summary is printed so the user sees exactly what changed.
+ */
+export declare function migratePreV5Install(input: V5MigrationInput): void;
+/**
+ * Test helper: enumerate removed agent/command ids so specs can assert the
+ * migration set stays in lock-step with the deleted templates.
+ */
+export declare const V5_REMOVED: {
+    readonly agents: readonly ["sr-product-manager", "sr-product-analyst", "sr-test-writer", "sr-doc-sync", "sr-merge-resolver", "sr-frontend-developer", "sr-backend-developer", "sr-frontend-reviewer", "sr-backend-reviewer", "sr-security-reviewer", "sr-performance-reviewer"];
+    readonly commands: readonly ["enrich", "reconfig", "vpc-drift", "auto-propose-backlog-specs", "get-backlog-specs", "merge-resolve", "test"];
+};

package/dist/installer/phases/framework-lifecycle.d.ts

@@ -0,0 +1,53 @@
+import { type Provider } from './provider-detect.js';
+/**
+ * Stable provider order for the global framework store. `framework/current` is
+ * shared by every relocated workspace, so a version transition must carry
+ * forward every provider that can still have live links through that pointer.
+ */
+export declare const FRAMEWORK_PROVIDERS: readonly Provider[];
+export interface ResolveRequiredFrameworkProvidersInput {
+    frameworkDir: string;
+    /** Providers requested by the lifecycle operation that is about to swap. */
+    requested?: readonly Provider[];
+    /** Registry home. Defaults to SPECRAILS_REGISTRY_HOME / the normal home. */
+    registryHome?: string;
+}
+export interface MaterializeFrameworkVersionInput extends ResolveRequiredFrameworkProvidersInput {
+    scriptDir: string;
+    version: string;
+}
+/**
+ * Discover providers represented by a framework version.
+ *
+ * A provider is included when either its subtree or its stamp exists. For the
+ * current version this is deliberately conservative: an interrupted/legacy
+ * materialization without a stamp may still have live workspace symlinks, so
+ * the next version must carry that provider forward rather than dropping it.
+ */
+export declare function discoverFrameworkProviders(frameworkDir: string, version: string): Provider[];
+/**
+ * Compute the provider set that MUST exist in a destination version before the
+ * process may move the global `current` pointer:
+ *
+ *  1. providers requested by this operation;
+ *  2. every supported provider recorded by any project in registry.json;
+ *  3. every provider represented by the version currently serving workspaces.
+ *
+ * Taking the global registry union (not just the active project) is essential:
+ * `framework/current` is global, while provider inventories are per project.
+ */
+export declare function resolveRequiredFrameworkProviders(input: ResolveRequiredFrameworkProvidersInput): Provider[];
+/**
+ * Fail closed when a destination version is missing or only partially
+ * materialized. A valid provider requires BOTH its provider subtree and the
+ * final stamp written after scaffold completion, with matching version/provider
+ * fields. The caller may supply an empty requirement only for a first install;
+ * in that case at least one complete provider must be discoverable in target.
+ */
+export declare function assertFrameworkVersionComplete(frameworkDir: string, version: string, requiredProviders: readonly Provider[]): Provider[];
+/**
+ * Materialize a complete destination version and expose it with ONE atomic
+ * pointer swap. No call in the provider loop can move `current`; if any provider
+ * fails, existing workspaces continue resolving through the previous version.
+ */
+export declare function materializeFrameworkVersion(input: MaterializeFrameworkVersionInput): Provider[];

package/dist/installer/phases/install-config.d.ts

@@ -0,0 +1,64 @@
+import { InstallerError } from '../util/errors.js';
+/**
+ * Provider identifier. Kept in lock-step with `provider-detect.ts` `Provider`.
+ */
+export type Provider = 'claude' | 'codex' | 'gemini' | 'kimi';
+/** Cost / capability preset for the model picker. */
+export type ModelPreset = 'balanced' | 'budget' | 'max';
+/** Provider-native model selection retained verbatim in install-config.yaml. */
+export interface InstallModelConfig {
+    preset: ModelPreset;
+    defaults: {
+        model: string;
+    };
+    overrides: Record<string, string>;
+}
+/**
+ * Shape of the `.specrails/install-config.yaml` file — the single
+ * source of truth the TUI writes and the installer reads. Fields map
+ * 1:1 onto the grep-based parser in the retired install.sh.
+ */
+export interface InstallConfig {
+    version: 1;
+    provider: Provider;
+    agents: {
+        selected: string[];
+        excluded?: string[];
+        /** Legacy pre-models-section location, accepted for backward compatibility. */
+        preset?: ModelPreset;
+    };
+    models?: InstallModelConfig;
+}
+/**
+ * Resolve a preset into provider-native identifiers. Kimi currently exposes no
+ * Core-defined cost/capability tier mapping, so every named preset resolves to
+ * its explicit `k3` default. User-supplied exact identifiers are handled later
+ * and are never interpreted as Claude aliases.
+ */
+export declare function resolveProviderModelConfig(provider: Provider, preset?: ModelPreset): InstallModelConfig;
+export declare class InvalidConfigError extends InstallerError {
+    readonly errors: string[];
+    constructor(errors: string[]);
+}
+export declare const CONFIG_RELATIVE_PATH = ".specrails/install-config.yaml";
+/**
+ * Resolves the install-config path: explicit argument > repo-root default.
+ */
+export declare function resolveConfigPath(repoRoot: string, explicit?: string): string;
+/**
+ * Reads and parses the install-config. Returns `null` if the file is
+ * not present — caller decides whether that's an error or a fallback.
+ */
+export declare function loadInstallConfig(configPath: string): InstallConfig | null;
+/**
+ * Validates an already-parsed YAML document. Collects every error
+ * before throwing so the user sees them all at once (matches the
+ * bash installer's `_config_errors` accumulator behaviour).
+ */
+export declare function validateInstallConfig(raw: unknown): InstallConfig;
+/**
+ * Serialises an {@link InstallConfig} back to YAML and writes it with
+ * LF line endings. Used by `npx specrails-core update --reset-config`
+ * paths (not wired yet) and by tests.
+ */
+export declare function writeInstallConfig(configPath: string, config: InstallConfig): void;

package/dist/installer/phases/manifest.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Shape of the `.specrails/specrails-manifest.json` file the installer
+ * writes at install time. Consumers (specrails-desktop's compat check,
+ * the `doctor` command, update.sh) parse it to detect template drift.
+ */
+export interface SpecrailsManifest {
+    version: string;
+    installed_at: string;
+    /** Provider inventory is emitted only by provider-aware lifecycle callers. */
+    providers?: string[];
+    primary_provider?: string;
+    artifacts: Record<string, string>;
+}
+/**
+ * Computes a stable sha256 digest for a file, returned as `sha256:<hex>`.
+ */
+export declare function sha256Of(filePath: string): string;
+export interface BuildManifestInput {
+    /** Absolute path to the specrails-core source package directory. */
+    scriptDir: string;
+    /** Absolute path to the user's repo root where the manifest is written. */
+    repoRoot: string;
+    /** Version string from the specrails-core VERSION file. */
+    version: string;
+    /** Override "installed_at" — exposed for deterministic testing. */
+    installedAt?: string;
+    /** Provider(s) materialized by this lifecycle pass. Existing entries are unioned. */
+    providers?: string[];
+    primaryProvider?: string;
+}
+/**
+ * Walks `templates/**` plus the bundled doctor command file and
+ * produces a stable-sorted manifest.
+ *
+ * Stable-sort rule: artifact keys are sorted ascending by POSIX path.
+ */
+export declare function buildManifest(input: BuildManifestInput): SpecrailsManifest;
+/**
+ * Writes the manifest JSON and the companion version file under
+ * `.specrails/` in the user repo. Both files use LF terminators.
+ */
+export declare function writeManifestFiles(repoRoot: string, manifest: SpecrailsManifest): {
+    manifestPath: string;
+    versionPath: string;
+};

package/dist/installer/phases/prereqs.d.ts

@@ -0,0 +1,51 @@
+import { type Provider, type ProviderAvailability } from './provider-detect.js';
+/**
+ * OpenSpec 1.4.1, which the installer invokes during the default init/update
+ * flow, requires Node >=20.19.0. Keep this floor independent from Kimi's npm
+ * package requirement: SpecRails launches an externally installed Kimi CLI and
+ * does not require the Kimi npm distribution.
+ */
+export declare const MIN_NODE_VERSION = "20.19.0";
+export declare function isSupportedNodeVersion(version: string): boolean;
+/**
+ * Phase 1 prerequisite bundle. Mirrors install.sh's Phase 1 flow but
+ * with explicit options rather than a grab-bag of globals.
+ *
+ * Returns the resolved inputs later phases need — primarily the
+ * selected provider and the detected CLI availability.
+ */
+export interface PrereqOptions {
+    /** Absolute path to the target repository root. */
+    repoRoot: string;
+    /** --yes / -y equivalent — auto-init git, skip interactive prompts. */
+    autoYes: boolean;
+    /** Explicit --provider flag (if passed). */
+    explicitProvider?: Provider;
+    /** SPECRAILS_SKIP_PREREQS=1 equivalent — relax hard failures for CI. */
+    skipPrereqs: boolean;
+}
+export interface PrereqResult {
+    availability: ProviderAvailability;
+    provider: Provider;
+    /**
+     * OSS heuristics. Three signals must align for `isOss` to be true:
+     * a public GitHub repo (via `gh repo view`), at least one CI workflow
+     * file under `.github/workflows/`, and a `CONTRIBUTING.md` at the
+     * repo root or under `.github/`. Surfaced for downstream tooling that
+     * wants to tailor behaviour to open-source projects.
+     */
+    ossSignals: OssSignals;
+}
+export interface OssSignals {
+    hasGh: boolean;
+    publicRepo: boolean;
+    hasCi: boolean;
+    hasContributing: boolean;
+    isOss: boolean;
+}
+/**
+ * Orchestrates every prerequisite check that must pass before the
+ * installer proceeds to Phase 3 (scaffolding). Emits ok/warn/info
+ * lines matching the retired bash output.
+ */
+export declare function checkPrerequisites(options: PrereqOptions): Promise<PrereqResult>;

package/dist/installer/phases/provider-detect.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Provider detection + authentication checks. These mirror the Phase
+ * 1.2 / 1.3 branches of the retired install.sh.
+ */
+export type Provider = 'claude' | 'codex' | 'gemini' | 'kimi';
+/** Oldest TypeScript Kimi Code CLI release covered by this integration. */
+export declare const MIN_KIMI_VERSION = "0.27.0";
+export interface ProviderAvailability {
+    claude: boolean;
+    codex: boolean;
+    /** Optional so callers/tests predating Gemini still typecheck; absent = false. */
+    gemini?: boolean;
+    /** Optional so callers/tests predating Kimi still typecheck; absent = false. */
+    kimi?: boolean;
+}
+export interface ProviderDerivedPaths {
+    /** Root directory inside the user's repo: `.claude` / `.codex` / `.gemini` / `.kimi-code`. */
+    providerDir: string;
+    /** Instructions file relative to the artifact root. */
+    instructionsFile: string;
+}
+/**
+ * Detects which AI CLIs are on PATH. Runs `where` on Windows and
+ * `which` on POSIX via the cross-platform commandExists helper.
+ */
+export declare function detectAvailability(): Promise<ProviderAvailability>;
+/**
+ * Returns the Claude CLI version string (stdout of `claude --version`)
+ * or 'unknown' if the CLI cannot be invoked.
+ */
+export declare function claudeVersion(): Promise<string>;
+/** Returns the raw Kimi Code CLI version or `unknown` when it cannot be probed. */
+export declare function kimiVersion(): Promise<string>;
+/** Extracts a semver-like triple from version output such as `kimi-code 0.27.0`. */
+export declare function parseCliVersion(raw: string): string | null;
+/** True when `raw` identifies a Kimi CLI at or above {@link MIN_KIMI_VERSION}. */
+export declare function isSupportedKimiVersion(raw: string): boolean;
+/**
+ * Resolves which provider the installer should use. Priority:
+ *   1. Explicit `--provider claude` flag (already passed through args).
+ *   2. Config file (read upstream in install-config.ts).
+ *   3. Whichever CLI is installed.
+ *
+ * The caller may bypass prereq failures with `skipPrereqs: true`
+ * (env `SPECRAILS_SKIP_PREREQS=1`).
+ */
+export declare function resolveProvider(availability: ProviderAvailability, options?: {
+    explicit?: Provider;
+    skipPrereqs?: boolean;
+}): Promise<Provider>;
+/**
+ * Directory / filename conventions the provider dictates.
+ *   - Claude Code:  .claude/ + CLAUDE.md
+ *   - Codex:        .codex/  + AGENTS.md
+ *   - Gemini CLI:   .gemini/ + GEMINI.md
+ *   - Kimi Code:    .kimi-code/ + AGENTS.md
+ */
+export declare function derivedPaths(provider: Provider): ProviderDerivedPaths;
+/**
+ * Asserts that Claude Code is authenticated. Matches the three-path
+ * check from install.sh: `claude config list` → ANTHROPIC_API_KEY env →
+ * ~/.claude.json OAuth.
+ */
+export declare function assertClaudeAuthenticated(options?: {
+    skipPrereqs?: boolean;
+}): Promise<void>;
+export type KimiAuthenticationStatus = 'authenticated' | 'unauthenticated' | 'unknown';
+/**
+ * Bounded, non-billing Kimi authentication probe.
+ *
+ * Kimi 0.27 has no CLI command that proves managed OAuth readiness without
+ * starting a model request. We therefore recognise non-secret evidence (the
+ * managed credential file or a process-scoped model key), and honour explicit
+ * login failures emitted by `kimi doctor`. A successful `kimi doctor` only
+ * validates configuration, so it deliberately yields `unknown`.
+ */
+export declare function probeKimiAuthentication(options?: {
+    kimiCodeHome?: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<KimiAuthenticationStatus>;
+/**
+ * Rejects only a conclusive login failure. `unknown` is allowed because setup
+ * must not spend quota merely to prove authentication.
+ */
+export declare function assertKimiAuthenticated(options?: {
+    skipPrereqs?: boolean;
+    kimiCodeHome?: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<KimiAuthenticationStatus>;