/**
 * Automatic Device Flow orchestration triggered when a skill call finds no
 * token. Only ever invoked AFTER resolvePrivToken() has confirmed all three
 * sources (flag / env / credential store) are empty, so the env-injected
 * (cloud) path never reaches this module — guaranteeing zero regression there.
 *
 * Flow (see design.md):
 *   canAutoAuth gate → acquire lock
 *     ├─ won  : runDeviceFlow(short wait) → on approval re-read the store
 *     └─ lost : wait for whoever holds the lock to write a credential
 *
 * Always bounded by `maxWaitMs` so it can never block a host tool call forever.
 */
import { type ResolvedToken } from './resolve.js';
/**
 * Attempt to obtain a token via automatic browser authorization. Returns the
 * resolved token on success, or null when auto auth is not applicable / did not
 * complete in time (callers then fail fast with NOT_AUTHENTICATED_HINT).
 */
export declare function attemptAutoLogin(apiBaseUrl: string): Promise<ResolvedToken | null>;