export type AuthMode = 'inherit' | 'subscription' | 'api-key' | 'auto';
export type AuthMechanism = 'subscription' | 'api-key';
export interface AuthStatusResult {
    loggedIn: boolean;
    authMethod?: string;
    apiKeySource?: string;
}
export type AuthStatusProbe = (env: NodeJS.ProcessEnv) => AuthStatusResult | null;
export interface ResolveAuthOptions {
    mode: AuthMode;
    requireAuth?: AuthMechanism;
    sourceEnv: NodeJS.ProcessEnv;
    /** Injected in tests; defaults to the real CLI probe in production. */
    probe?: AuthStatusProbe;
    modelVars?: string[];
}
export interface ResolvedAuth {
    forwardedEnv: NodeJS.ProcessEnv;
    effectiveMechanism: AuthMechanism;
    authMethod?: string;
    apiKeySource?: string;
}
/** A preflight auth failure — maps to exit code 2. */
export declare class AuthPreflightError extends Error {
    readonly exitCode: 2;
    constructor(message: string);
}
/**
 * Token-free auth probe (spec §8/§10). Runs `claude auth status --json` in the
 * given env: returns in ~150ms, exit 0, spends NO tokens. NOT a `-p` call.
 */
export declare function probeAuthStatus(env: NodeJS.ProcessEnv): AuthStatusResult | null;
export declare function resolveAuth(opts: ResolveAuthOptions): ResolvedAuth;
//# sourceMappingURL=auth-resolver.d.ts.map