/**
 * Auth Coordinator — Executor-level authentication handoff
 *
 * Extracted from executor/index.ts (Phase 06).
 * Handles:
 * - --logout early exit
 * - --import token early exit (Kiro only)
 * - --auth / forceAuth OAuth flow (single + composite providers)
 * - Antigravity responsibility gate (run and oauth contexts)
 * - isAuthenticated checks + automatic OAuth trigger
 * - Proactive token refresh (multi-provider for composite)
 * - lastUsedAt touch via touchDefaultAccount
 * - Preflight quota check
 * - Account safety guards (cross-provider isolation)
 * - First-run model configuration
 *
 * ORDERING (load-bearing — do not change):
 *   1. logout/import/forceAuth early exits
 *   2. Remote-proxy auth skip detection
 *   3. Antigravity gate (oauth context: remote+forceAuth | run context: else branch)
 *   4. OAuth check / trigger (single or composite)
 *   5. Token refresh
 *   6. lastUsedAt touch
 *   7. Preflight quota check
 *   8. Account safety guards
 *   9. First-run model configuration
 */
import { CLIProxyProvider, ExecutorConfig } from '../types';
import type { ParsedExecutorFlags } from './arg-parser';
import type { UnifiedConfig } from '../../config/schemas/unified-config';
export interface AuthCoordinationContext {
    provider: CLIProxyProvider;
    compositeProviders: CLIProxyProvider[];
    parsedFlags: ParsedExecutorFlags;
    cfg: ExecutorConfig;
    unifiedConfig: UnifiedConfig;
    verbose: boolean;
    log: (msg: string) => void;
}
/**
 * Handle --logout: clear auth and exit 0.
 * Returns true if early exit occurred (caller should return immediately).
 */
export declare function handleLogout(context: AuthCoordinationContext): Promise<boolean>;
/**
 * Handle --import: Kiro-only token import flow, exits when done.
 * Returns true if early exit occurred.
 */
export declare function handleImport(context: AuthCoordinationContext): Promise<boolean>;
/**
 * Returns true when a remote proxy with an authToken is active —
 * local OAuth is not needed in this case.
 */
export declare function resolveSkipLocalAuth(remoteAuthToken: string | undefined, useRemoteProxy: boolean): boolean;
/**
 * Runs the Antigravity responsibility gate for the relevant code path.
 *
 * Two scenarios (must match original ordering in index.ts):
 *   A. provider=agy + forceAuth + skipLocalAuth → oauth-context gate; if refused, log and return
 *      (caller must return early — this function returns { earlyReturn: true })
 *   B. provider=agy + !forceAuth + (skipLocalAuth || !requiresAuthNow) → run-context gate;
 *      if refused, log and process.exit(1)
 *
 * Returns { earlyReturn: true } when the caller should return immediately (case A refused).
 */
export declare function runAntigravityGate(context: AuthCoordinationContext, skipLocalAuth: boolean): Promise<{
    earlyReturn: boolean;
}>;
/**
 * Ensure provider(s) are authenticated; trigger OAuth if needed.
 * Handles both composite (multi-provider) and single-provider flows.
 * Also runs proactive token refresh and touches lastUsedAt.
 *
 * Only called when providerConfig.requiresOAuth && !skipLocalAuth.
 */
export declare function ensureProviderAuthentication(context: AuthCoordinationContext): Promise<void>;
/**
 * Preflight quota check for providers with quota-based rotation.
 * Only runs when !skipLocalAuth.
 */
export declare function runPreflightQuotaCheck(provider: CLIProxyProvider, compositeProviders: CLIProxyProvider[]): Promise<void>;
/**
 * Enforce cross-provider account isolation. Only runs when !skipLocalAuth.
 */
export declare function runAccountSafetyGuards(provider: CLIProxyProvider, compositeProviders: CLIProxyProvider[]): void;
/**
 * Ensure provider model is configured on first run.
 * Skipped for composite variants and remote proxy mode.
 * Also reconciles Codex model for active plan.
 */
export declare function ensureModelConfiguration(provider: CLIProxyProvider, cfg: ExecutorConfig, verbose: boolean): Promise<void>;
/**
 * Ensure the provider settings file exists.
 */
export declare function ensureProviderSettingsFile(provider: CLIProxyProvider): void;
//# sourceMappingURL=auth-coordinator.d.ts.map