/**
 * Read the global startup-auth configuration before Settings is initialized.
 *
 * The config file is canonical nested YAML only. Legacy literal dotted auth keys
 * are rejected with a manual rewrite diagnostic; no compatibility migration is
 * performed. Environment values are trusted credential sources and take
 * precedence over global config values.
 */
import type { AuthCredentialSelector, CredentialRankingMode } from "@gajae-code/ai/core";
export interface AuthBrokerClientConfig {
    url: string;
    token: string;
}
export interface StartupAuthConfigSnapshot {
    broker: AuthBrokerClientConfig | null;
    /** Opaque credential-store authority used to bind numeric row-id pins. */
    credentialStoreIdentity: string;
    /** Persisted authority for global numeric pins; absent values invalidate ID pins. */
    credentialPinStoreIdentity?: string;
    credentialRankingMode: CredentialRankingMode;
    credentialPins: Readonly<Record<string, string>>;
}
export type StartupAuthConfigErrorKind = "unreadable" | "invalid-yaml" | "non-mapping-root" | "invalid-auth" | "invalid-broker" | "invalid-gateway" | "invalid-ranking-mode" | "invalid-credential-pins";
/** A malformed startup-auth config aborts resolution rather than downgrading to local authority. */
export declare class StartupAuthConfigError extends Error {
    readonly kind: StartupAuthConfigErrorKind;
    readonly name = "StartupAuthConfigError";
    readonly code: StartupAuthConfigErrorKind;
    readonly causeClass: StartupAuthConfigErrorKind;
    constructor(kind: StartupAuthConfigErrorKind, configPath: string);
}
/** JSON-schema pattern shared with the runtime persisted-selector grammar. */
export declare const PERSISTED_CREDENTIAL_SELECTOR_PATTERN = "^(id:[1-9][0-9]*|email:[^@\\s]+@[^@\\s]+|account:\\S+)$";
/** Path to the local bearer token file. Created on the broker host by `gjc auth-broker token`. */
export declare function getAuthBrokerTokenFilePath(): string;
/** Validate the persisted selector grammar used by `auth.credentialPins`. */
export declare function parsePersistedCredentialSelector(value: string): AuthCredentialSelector | undefined;
export declare function isValidPersistedCredentialSelector(value: string): boolean;
/**
 * Resolve one typed startup-auth snapshot from trusted env and global config.
 * Project settings are intentionally not read here, so project-scoped pins
 * cannot influence credential selection.
 */
export declare function resolveStartupAuthConfig(agentDir?: string): Promise<StartupAuthConfigSnapshot>;