/**
 * CLI Headless Helpers (Phase 4 roadmap 4.5, assignment E1)
 *
 * Pure decision logic + dependency-injected auth resolution for the
 * unattended CLI surface, extracted from cli.ts so the exit-code matrix and
 * the auth ordering are unit-testable without invoking commander
 * (cli-source-helpers / cli-limit-helpers precedent).
 *
 * ## CI exit codes (`--ci` on check-updates / auto-update)
 *
 * Default behavior is unchanged (exit 0 on success). With `--ci`, the exit
 * code carries an automation signal for machine monitoring:
 *
 * | Code | Meaning                                                        |
 * |------|----------------------------------------------------------------|
 * | 0    | Clean — nothing to do, nothing failed                          |
 * | 1    | Fatal error (also the universal handleCliError code)           |
 * | 2    | Partial failures — some plugins failed to check/download        |
 * | 10   | Updates available (check) / applied or staged (auto-update)    |
 * | 20   | ONLY manual/premium updates pending (no automatic ones)        |
 * | 30   | Auth/tier gate refused an explicitly-requested gated feature   |
 *
 * Precedence: 1 (fatal) > 2 (partial failure) > 10 (updates) > 20 (manual
 * only) > 0 — a run with both failures and updates reports the failure,
 * because an unmonitored failure is worse than a missed update signal.
 *
 * @since v2.12.7
 */
import type { Tier } from './core/types/auth.js';
/** Exit codes for `--ci` runs (see module doc for the full matrix) */
export declare const CI_EXIT: {
    readonly CLEAN: 0;
    readonly FATAL: 1;
    readonly PARTIAL_FAILURE: 2;
    readonly UPDATES: 10;
    readonly MANUAL_ONLY: 20;
    readonly AUTH_REQUIRED: 30;
};
/** Inputs for {@link resolveCheckUpdatesExitCode} */
export interface CheckUpdatesExitInput {
    /** Plugins that failed to check */
    errorCount: number;
    /** Automatic updates available */
    updateCount: number;
    /** Premium/manual updates pending */
    manualCount: number;
}
/**
 * Exit code for `check-updates --ci` (pure; see CI_EXIT precedence).
 */
export declare function resolveCheckUpdatesExitCode(input: CheckUpdatesExitInput): number;
/** Inputs for {@link resolveAutoUpdateExitCode} */
export interface AutoUpdateExitInput {
    /** Failed checks/downloads */
    failedCount: number;
    /** Updates applied in place */
    updatedCount: number;
    /** Updates staged for the next server restart */
    stagedCount: number;
    /** Premium/manual updates pending */
    manualCount: number;
    /** Failed entries in the scheduled-promotion step (0 when promotion off) */
    promotionFailedCount?: number;
    /** Run was cancelled before completion */
    cancelled?: boolean;
}
/**
 * Exit code for `auto-update --ci` (pure; see CI_EXIT precedence).
 * A cancelled run is fatal — a half-finished unattended run must alarm.
 */
export declare function resolveAutoUpdateExitCode(input: AutoUpdateExitInput): number;
/**
 * Build the command string scheduler entries should invoke (audit
 * cli-headless F1 bonus finding: `process.argv[1]` under npm/bun installs is
 * a `.js` script path, not an executable — a cron line invoking it directly
 * fails with "exec format error" or runs it through the wrong interpreter).
 *
 * - Script path (.js/.ts/.mjs/.cjs): prefix with the running runtime
 *   (`process.execPath`), quoted for spaces.
 * - Bun compiled binary (argv[1] is a `$bunfs` virtual path): the binary
 *   itself IS the command — return execPath.
 * - Anything else (bin shim, plain binary path): use as-is.
 * - Missing argv[1]: fall back to `pluginator` and trust PATH.
 */
export declare function resolvePluginatorInvocation(argv1: string | undefined, execPath: string): string;
/**
 * The slice of AuthService the headless resolver needs (dependency-injected
 * so tests pin a mock instead of the singleton + network).
 */
export interface HeadlessAuthService {
    isAuthenticated(): boolean;
    hasPendingRefresh(): boolean;
    tryRefreshExpiredSession(): Promise<boolean>;
    loginWithToken(token: string): Promise<unknown>;
    getEffectiveTier(): Tier;
}
/** Result of {@link resolveHeadlessAuth} */
export interface HeadlessAuthResult {
    /** Effective tier after resolution ('free' when unauthenticated) */
    tier: Tier;
    authenticated: boolean;
    /** Diagnostics for stderr — NEVER stdout (--json purity) */
    warnings: string[];
}
/**
 * Resolve auth for a headless CLI command BEFORE any tier/usage gate.
 *
 * Order (audit F5/F6 — previously the env token only worked in the TUI path
 * and session refresh only ran from the TUI's useAuth hook, so a Pro
 * subscriber's 3am cron run started failing tier gates ≤24h after their last
 * interactive login):
 *
 * 1. Live session → use it.
 * 2. `PLUGINATOR_API_TOKEN` / `PLUGINATOR_PAT` env var → loginWithToken
 *    (explicit operator configuration wins over a stale session; same vars
 *    the TUI honors). Network call carries its own 10s timeout.
 * 3. Expired stored session → tryRefreshExpiredSession (10s timeout inside).
 * 4. Degrade to free-tier behavior with a warning — the caller decides
 *    whether the gated feature was explicitly requested (then exit
 *    CI_EXIT.AUTH_REQUIRED) or whether free-tier limits suffice.
 *
 * Never throws and never hangs: every network call above is bounded by the
 * auth service's own AbortSignal timeouts.
 */
export declare function resolveHeadlessAuth(auth: HeadlessAuthService, env?: NodeJS.ProcessEnv): Promise<HeadlessAuthResult>;
//# sourceMappingURL=cli-headless-helpers.d.ts.map