/**
 * CLI-side PKCE primitives + the loopback receiver (design: docs/designs/clustly-cli.md §4;
 * build-plan 3.3). The verifier NEVER leaves this process; the URL carries only context
 * (challenge · port · state). The loopback validates the one-shot `state` on every callback
 * and KEEPS LISTENING on a mismatch — a forged callback (login-CSRF attempt) must not be able
 * to kill the real one. Dependency-free: node:crypto + node:http.
 */
export declare const CALLBACK_PATH = "/callback";
export declare const LOGIN_TIMEOUT_MS: number;
export interface PkceContext {
    verifier: string;
    challenge: string;
    state: string;
}
export declare function mintPkceContext(): PkceContext;
export declare function authorizeUrl(webOrigin: string, ctx: PkceContext, port: number): string;
export interface Loopback {
    port: number;
    /** Resolves with the one-time code from the first state-valid callback; rejects on timeout. */
    code: Promise<string>;
    close(): void;
}
/** Start the temporary localhost receiver on a random port. */
export declare function startLoopback(state: string, timeoutMs?: number): Promise<Loopback>;