/**
 * The single authorization entry point for every skill invocation.
 *
 * Before this module the CLI resolved PrivTokens in three unrelated places:
 * `resolveHttpContext` (4 TS handlers, with credential store + auto device
 * login), `registry_loader.py` (1 Python skill, with its own credential-file
 * reader), and plain `os.environ["PRIV_TOKEN"]` (the other 7 Python skills,
 * which therefore ignored `remixmate login` entirely). Auto browser auth only
 * ever covered the first group.
 *
 * Now `runner.ts` calls `ensureAuth()` once, before dispatch, for every skill —
 * so the credential store, the OS keychain and the device flow exist in exactly
 * one place (Node), and Python scripts only ever read an injected `PRIV_TOKEN`.
 */
import { type CredentialSource } from './resolve.js';
/**
 * Per-skill authorization requirement, declared as `auth` in skill.json.
 *
 *  - `required`: no token → run the device flow; still no token → abort (exit 4).
 *  - `optional`: inject a token when one is already available, otherwise carry
 *                on silently. Never opens a browser — these skills degrade to a
 *                reduced mode (e.g. web-record keeps the file locally instead of
 *                uploading), and popping an auth window for that would be rude.
 *  - `none`:     purely local, never touches ab-api (e.g. web-screenshot).
 */
export type AuthMode = 'required' | 'optional' | 'none';
export declare const AUTH_MODE_VALUES: readonly ["required", "optional", "none"];
export interface AuthPreflight {
    /** Backend the invocation is bound to; injected so Python derives the same one. */
    apiBaseUrl: string;
    /** Absent only for `none`, or for `optional` with no credential available. */
    token?: string;
    source?: CredentialSource;
    userLabel?: string;
}
/**
 * Resolve (and if necessary acquire) a PrivToken for one skill invocation.
 * Throws SkillError(exit 4) when `mode === 'required'` and no token could be
 * obtained; the message is the shared NOT_AUTHENTICATED_HINT.
 */
export declare function ensureAuth(opts: {
    mode: AuthMode;
    apiBaseUrl?: string;
    flagToken?: string;
}): Promise<AuthPreflight>;
/**
 * Environment overrides handed to a spawned Python skill.
 *
 * `MM_API_BASE_URL` is always set so the child resolves the same backend the
 * preflight authenticated against — otherwise a `--api-base-url` flag or a
 * credential bound to a staging backend would silently disagree with the URL
 * the Python side derives. `PRIV_TOKEN` is only set when non-empty, so an
 * `optional` skill without a credential keeps inheriting whatever the host set.
 */
export declare function authChildEnv(pre: AuthPreflight): Record<string, string>;