namespace ClaudeDo.Worker.Online.Interfaces;

public interface IOnlineAuthProvider
{
    Task<string?> GetAccessTokenAsync(CancellationToken ct = default);

    /// <summary>
    /// Gets an access token, optionally dropping any cached token first so a fresh
    /// (role-bearing) token is minted via the refresh-token grant. Used to recover from a
    /// 401 caused by a stale token issued before role assertion was enabled.
    /// </summary>
    Task<string?> GetAccessTokenAsync(bool forceRefresh, CancellationToken ct = default);
}