import { type AuthCapabilityBinding as AuthCapabilityBindingType, type AuthCapabilityReceipt as AuthCapabilityReceiptType, type AuthRequest, type AuthSmokeDisclosure as AuthSmokeDisclosureType, type AuthSourceKind, type CredentialRoute } from "@claudexor/schema";
import type { AdapterRegistry, HarnessAdapter } from "./adapter.js";
export interface AuthCapabilityPreparationRequest {
    attemptId: string;
    harness: string;
    requested: AuthRequest;
    requiredRoute: CredentialRoute;
    requiredSource: AuthSourceKind;
}
export interface AuthCapabilityPreparation {
    binding: AuthCapabilityBindingType;
}
export interface AuthCapabilityVerificationRequest {
    binding: AuthCapabilityBindingType;
    startedAt: string;
    abortSignal?: AbortSignal;
}
export interface AuthCapabilityVerifierDeps {
    now?: () => Date;
    receiptId?: () => string;
    scratchRoot?: string;
}
/**
 * Executes one ordinary adapter run and reduces only typed normalized events
 * into a redacted exact-route receipt. It owns an external scratch tree, never
 * discovers a second adapter, and never persists model output.
 */
export declare class AuthCapabilityVerifier {
    private readonly adapter;
    private readonly now;
    private readonly receiptId;
    private readonly scratchRoot;
    constructor(adapter: (id: string) => HarnessAdapter | undefined, deps?: AuthCapabilityVerifierDeps);
    static fromRegistry(registry: AdapterRegistry, deps?: AuthCapabilityVerifierDeps): AuthCapabilityVerifier;
    disclosure(harness: string, requested: AuthRequest, requiredRoute: CredentialRoute, requiredSource: AuthSourceKind): AuthSmokeDisclosureType;
    prepare(request: AuthCapabilityPreparationRequest): AuthCapabilityPreparation;
    verify(request: AuthCapabilityVerificationRequest): Promise<AuthCapabilityReceiptType>;
    /** Remove only the verifier-owned directory for a validated durable attempt. */
    cleanup(attemptId: string): void;
    private createScratch;
}
//# sourceMappingURL=auth-capability-verifier.d.ts.map