/**
 * Single source of truth for PrivToken resolution precedence, shared by the
 * CLI commands and the HTTP layer (src/http.ts wires this in — Wave 2 task 4.3).
 *
 * Precedence (high → low), per requirements 7.1–7.4:
 *   1. explicit --token flag (caller override)
 *   2. PRIV_TOKEN environment variable  (CI / agent-embedded hosts)
 *   3. Credential_Store entry for the active API base URL (written by `login`)
 *
 * A value that is empty after trimming whitespace is treated as ABSENT, so an
 * exported-but-empty `PRIV_TOKEN=""` falls through to the credential store
 * rather than masking it.
 */
export type CredentialSource = 'flag' | 'env' | 'credential-store';
export interface ResolvedToken {
    privToken: string;
    source: CredentialSource;
    /** Present only for the credential-store source. */
    userLabel?: string;
}
/**
 * Resolve the PrivToken following the documented precedence. Returns null when
 * no source yields a token (callers render the not-authenticated message).
 */
export declare function resolvePrivToken(opts: {
    flag?: string;
    apiBaseUrl: string;
}): Promise<ResolvedToken | null>;
/** Human-readable hint shown when resolution fails (no token echoed). */
export declare const NOT_AUTHENTICATED_HINT = "\u274C not authenticated \u2014 run `remixmate login`, set PRIV_TOKEN, or pass --token";