import { type ClaudeInvoker } from '../invoker.js';
/**
 * How account credentials behave on this machine:
 * - `isolated`: a fresh CLAUDE_CONFIG_DIR is logged out, so config-dir rotation
 *   (the junction) isolates accounts. True on Windows and Linux.
 * - `shared`: a fresh CLAUDE_CONFIG_DIR still reports logged in, so credentials
 *   come from a shared store (the macOS Keychain). Config-dir rotation will NOT
 *   isolate accounts; use CLAUDE_CODE_OAUTH_TOKEN rotation instead.
 */
export type IsolationMode = 'isolated' | 'shared';
export interface PreflightDeps {
    /** Whether a brand-new, empty config dir reports logged in. */
    probeEmptyDirLoggedIn: () => boolean;
}
/**
 * Pure decision: if an empty config dir is still logged in, credentials are
 * shared (Keychain); otherwise they are per-dir and isolation holds.
 */
export declare function classifyIsolation(deps: PreflightDeps): IsolationMode;
/** Recommended rotation mechanism for a given isolation mode. */
export declare function recommendedMechanism(mode: IsolationMode): 'junction' | 'oauth-token';
/**
 * Real detector: run `claude auth status` against a throwaway empty config dir
 * and report whether credentials are per-dir (isolated) or shared. No model
 * tokens are spent. This is how the tool verifies its assumptions on the actual
 * machine instead of guessing per-OS.
 */
export declare function detectIsolation(claude: ClaudeInvoker): Promise<IsolationMode>;