import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-Bpmgm2Po.mjs';
import { C as CliDescriptor, a as CloudflareAuth, A as AuthContext, b as CloudflareLoginProps, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-CWjI7ct9.mjs';
import '@cloudflare/workers-utils';

/**
 * A TOML-file-on-disk storage backend, parameterised by the path it reads and
 * writes. Wrangler's historical file format is TOML, so this is a thin
 * `TOML`-bound wrapper over the CLI-agnostic {@link createFileStorage}.
 */
declare function createTomlFileStorage<T extends object>(getPath: () => string): ConfigStorage<T>;
declare const getAuthConfigFilePath: (profile?: string) => string;
declare const getEncryptedAuthConfigFilePath: (profile?: string) => string;
declare const defaultAuthConfigStorage: (profile?: string) => AuthConfigStorage;
declare const readAuthConfigFile: (profile?: string) => UserAuthConfig | undefined;
declare const writeAuthConfigFile: (config: UserAuthConfig, profile?: string) => void;

declare const DefaultScopes: {
    readonly "account:read": "See your account info such as account details, analytics, and memberships.";
    readonly "user:read": "See your user info such as name, email address, and account memberships.";
    readonly "workers:write": "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.";
    readonly "workers_kv:write": "See and change Cloudflare Workers KV Storage data such as keys and namespaces.";
    readonly "workers_routes:write": "See and change Cloudflare Workers data such as filters and routes.";
    readonly "workers_scripts:write": "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.";
    readonly "workers_tail:read": "See Cloudflare Workers tail and script data.";
    readonly "d1:write": "See and change D1 Databases.";
    readonly "pages:write": "See and change Cloudflare Pages projects, settings and deployments.";
    readonly "zone:read": "Grants read level access to account zone.";
    readonly "ssl_certs:write": "See and manage mTLS certificates for your account";
    readonly "ai:write": "See and change Workers AI catalog and assets";
    readonly "ai-search:write": "See and change AI Search data";
    readonly "ai-search:run": "Run search queries on your AI Search instances";
    readonly "agent-memory:write": "See and change Agent Memory data such as keys and namespaces.";
    readonly "queues:write": "See and change Cloudflare Queues settings and data";
    readonly "pipelines:write": "See and change Cloudflare Pipelines configurations and data";
    readonly "secrets_store:write": "See and change secrets + stores within the Secrets Store";
    readonly "artifacts:write": "See and change Cloudflare Artifacts data such as registries and artifacts";
    readonly "flagship:write": "See and change Flagship feature flags and apps";
    readonly "containers:write": "Manage Workers Containers";
    readonly "cloudchamber:write": "Manage Cloudchamber";
    readonly "connectivity:admin": "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel.";
    readonly "email_routing:write": "See and change Email Routing settings, rules, and destination addresses.";
    readonly "email_sending:write": "See and change Email Sending settings and configuration.";
    readonly "browser:write": "See and manage Browser Run sessions";
    readonly "challenge-widgets.write": "See and change Turnstile widgets";
};
/**
 * The possible keys for a Scope.
 *
 * "offline_access" is automatically included.
 */
type Scope = keyof typeof DefaultScopes;
declare let DefaultScopeKeys: Scope[];
declare function setLoginScopeKeys(scopes: Scope[]): void;
declare function validateScopeKeys(scopes: string[]): scopes is typeof DefaultScopeKeys;

/**
 * `WRANGLER_CLIENT_ID` is the UUID of Wrangler's registered OAuth app, used to
 * identify Wrangler to the Cloudflare OAuth server.
 *
 * This is wrangler CLI config (the app UUIDs and the `WRANGLER_*` variable
 * name are Wrangler's), so it lives in the `/wrangler` layer rather than the
 * shared core — a future `/cf` entrypoint has its own OAuth app.
 *
 * Normally you should not need to set this explicitly. To switch to the staging
 * environment set `WRANGLER_API_ENVIRONMENT=staging` instead.
 */
declare const getClientIdFromEnv: () => string;

/**
 * Keyring service identifier passed to `createCredentialStorageContext` and to
 * the opt-out scrub in wrangler's `commands.ts`. Exported (re-exported from
 * `./index.ts`) so every site stays in sync — this becomes the `-s` arg to
 * macOS `security`, the `service` attribute for Linux `secret-tool`, and the
 * `service` arg to `@napi-rs/keyring`'s `Entry` on Windows.
 */
declare const WRANGLER_KEYRING_SERVICE_NAME = "wrangler";
/** The `redirect_uri` registered on Wrangler's OAuth app. */
declare const OAUTH_CALLBACK_URL = "http://localhost:8976/oauth/callback";

/** @deprecated Use {@link AuthContext}. Kept as an alias for wrangler's historical name. */
type WranglerAuthContext = AuthContext;
/** @deprecated Use {@link CloudflareAuth}. */
type WranglerAuth = CloudflareAuth;
/** @deprecated Use {@link CloudflareLoginProps}. */
type WranglerLoginProps = CloudflareLoginProps;
/**
 * The wrangler {@link CliDescriptor}: TOML files under wrangler's global config
 * directory, wrangler's OAuth app / consent pages, the `"wrangler"` keyring
 * service, and wrangler-worded copy.
 */
declare const WRANGLER_CLI: CliDescriptor;
declare const readUserPreferences: () => UserPreferences;
declare const updateUserPreferences: (update: Partial<UserPreferences>) => void;

/**
 * Build wrangler's auth layer, injecting the few consumer primitives that can't
 * move into the shared package (logger, interactive `prompt` / `select`, and
 * the User-Agent string).
 */
declare function createWranglerAuth(ctx: AuthContext): CloudflareAuth;
/** Consumer primitives {@link createWranglerProfileStore} needs. */
interface WranglerProfileStoreContext {
    logger: OAuthFlowContext["logger"];
}
/**
 * Build wrangler's {@link ProfileStore} (TOML `.toml` / `.enc` files under the
 * global config dir), bound to wrangler's config path, keyring service, and
 * TOML format.
 */
declare function createWranglerProfileStore(ctx: WranglerProfileStoreContext): ProfileStore;
/**
 * Apply and persist the global keyring-storage preference. Shared by
 * `wrangler auth keyring enable|disable` and `wrangler login --use-keyring` /
 * `--no-use-keyring`.
 */
declare function setKeyringPreference(enabled: boolean, ctx: KeyringPreferenceContext): SetKeyringPreferenceResult;

export { DefaultScopeKeys, DefaultScopes, KeyringPreferenceContext, OAUTH_CALLBACK_URL, type Scope, SetKeyringPreferenceResult, UserPreferences, WRANGLER_CLI, WRANGLER_KEYRING_SERVICE_NAME, type WranglerAuth, type WranglerAuthContext, type WranglerLoginProps, type WranglerProfileStoreContext, createTomlFileStorage, createWranglerAuth, createWranglerProfileStore, defaultAuthConfigStorage, getAuthConfigFilePath, getClientIdFromEnv, getEncryptedAuthConfigFilePath, readAuthConfigFile, readUserPreferences, setKeyringPreference, setLoginScopeKeys, updateUserPreferences, validateScopeKeys, writeAuthConfigFile };