export declare const CLI_OAUTH_PUBLIC_CLIENT_ID = "cli";
export declare const CLI_OAUTH_RESPONSE_TYPE = "code";
export declare const CLI_OAUTH_REDIRECT_PATH = "/auth/callback";
export declare const CLI_OAUTH_SUPPORTED_SCOPES: readonly ["tools:read", "tools:write", "notifications:read", "wallet:read", "wallet:execute", "offline_access"];
export declare const CLI_OAUTH_REQUIRED_SCOPES: readonly ["offline_access"];
export type CliOAuthScope = (typeof CLI_OAUTH_SUPPORTED_SCOPES)[number];
export declare const CLI_OAUTH_DEFAULT_SCOPES: readonly ["offline_access", "tools:read", "wallet:read"];
export declare const CLI_OAUTH_WRITE_SCOPES: readonly ["offline_access", "tools:read", "tools:write", "wallet:execute", "wallet:read"];
export declare const CLI_OAUTH_NOTIFICATIONS_READ_SCOPES: readonly ["notifications:read", "offline_access", "tools:read", "wallet:read"];
export declare const CLI_OAUTH_NOTIFICATIONS_WRITE_SCOPES: readonly ["notifications:read", "offline_access", "tools:read", "tools:write", "wallet:execute", "wallet:read"];
export declare const CLI_SETUP_WALLET_MODES: readonly ["hosted", "local-generate", "local-key", "skip"];
export declare const CLI_OAUTH_DEFAULT_SCOPE: string;
export declare const CLI_OAUTH_WRITE_SCOPE: string;
export declare const CLI_OAUTH_NOTIFICATIONS_READ_SCOPE: string;
export declare const CLI_OAUTH_NOTIFICATIONS_WRITE_SCOPE: string;
export type CliSetupWalletModeHint = (typeof CLI_SETUP_WALLET_MODES)[number];
type SearchParamReader = Pick<URLSearchParams, "get">;
export type CliOAuthAuthorizeRequest = {
    responseType: typeof CLI_OAUTH_RESPONSE_TYPE;
    clientId: string;
    redirectUri: string;
    scope: string;
    scopes: string[];
    codeChallenge: string;
    codeChallengeMethod: "S256";
    state: string;
    agentKey: string;
    label?: string;
    walletMode?: CliSetupWalletModeHint;
};
export type CliOAuthAuthorizeParseResult = {
    ok: true;
    value: CliOAuthAuthorizeRequest;
} | {
    ok: false;
    error: string;
};
export declare function splitScope(scope: string): string[];
export declare function normalizeScope(scope: string): string;
export declare function validateScope(scope: string): string;
export declare function hasScope(scope: string, required: string): boolean;
export declare function hasToolsWrite(scope: string): boolean;
export declare function hasWalletExecute(scope: string): boolean;
export declare function hasWriteToolCapability(scope: string): boolean;
export declare function hasAnyWriteCapability(scope: string): boolean;
export declare function defaultCliScope(): string;
export declare function validatePkceCodeChallenge(value: string): string;
export declare function validatePkceCodeVerifier(value: string): string;
export declare function deriveS256CodeChallenge(codeVerifier: string): Promise<string>;
export declare function verifyPkceS256(params: {
    codeVerifier: string;
    codeChallenge: string;
}): Promise<boolean>;
export declare function createPkceVerifier(): string;
export declare function createPkcePair(): Promise<{
    codeVerifier: string;
    codeChallenge: string;
}>;
export declare function validateCliRedirectUri(rawRedirectUri: string): string;
export declare function normalizeCliSessionLabel(rawLabel: string | undefined): string | undefined;
export declare function validateCliOAuthAuthorizeRequest(input: {
    responseType: string;
    clientId: string;
    redirectUri: string;
    scope: string;
    codeChallenge: string;
    codeChallengeMethod: string;
    state: string;
    agentKey: string;
    label?: string;
    walletMode?: string;
}): CliOAuthAuthorizeRequest;
export declare function parseCliOAuthAuthorizeQuery(searchParams: SearchParamReader): CliOAuthAuthorizeParseResult;
export type CliOAuthAuthorizeCodeRequestBody = {
    clientId: string;
    redirectUri: string;
    scope: string;
    codeChallenge: string;
    codeChallengeMethod: "S256";
    state: string;
    agentKey: string;
    label?: string;
};
export type CliOAuthAuthorizeCodeResponse = {
    code: string;
    state: string;
    redirectUri: string;
    expiresIn: number;
};
export type CliOAuthTokenRequestBody = {
    grantType: string;
    clientId: string;
    code?: string;
    redirectUri?: string;
    codeVerifier?: string;
    refreshToken?: string;
};
export type CliOAuthTokenResponse = {
    tokenType: "Bearer";
    accessToken: string;
    expiresIn: number;
    refreshToken: string;
    scope: string;
    sessionId: string;
    canWrite: boolean;
};
export type CliOAuthErrorResponse = {
    error: string;
    errorDescription: string;
};
export declare const cliOAuthAuthorizeCodeRequestBodyJsonSchema: {
    readonly type: "object";
    readonly additionalProperties: false;
    readonly required: readonly ["client_id", "redirect_uri", "scope", "code_challenge", "code_challenge_method", "state", "agent_key"];
    readonly properties: {
        readonly client_id: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 64;
        };
        readonly redirect_uri: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 2048;
        };
        readonly scope: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 1024;
        };
        readonly code_challenge: {
            readonly type: "string";
            readonly minLength: 43;
            readonly maxLength: 128;
        };
        readonly code_challenge_method: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 16;
        };
        readonly state: {
            readonly type: "string";
            readonly minLength: 8;
            readonly maxLength: 512;
        };
        readonly agent_key: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 64;
            readonly pattern: "^[A-Za-z0-9._-]+$";
        };
        readonly label: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 128;
            readonly pattern: "^[A-Za-z0-9 ._()\\-]+$";
        };
    };
};
export declare const cliOAuthTokenRequestBodyJsonSchema: {
    readonly type: "object";
    readonly additionalProperties: false;
    readonly required: readonly ["grant_type", "client_id"];
    readonly properties: {
        readonly grant_type: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 64;
        };
        readonly client_id: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 64;
        };
        readonly code: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 512;
        };
        readonly redirect_uri: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 2048;
        };
        readonly code_verifier: {
            readonly type: "string";
            readonly minLength: 43;
            readonly maxLength: 128;
        };
        readonly refresh_token: {
            readonly type: "string";
            readonly minLength: 1;
            readonly maxLength: 1024;
        };
    };
};
export declare function parseCliOAuthAuthorizeCodeRequestBody(input: unknown): CliOAuthAuthorizeCodeRequestBody;
export declare function serializeCliOAuthAuthorizeCodeRequestBody(input: Pick<CliOAuthAuthorizeCodeRequestBody, "clientId" | "redirectUri" | "scope" | "codeChallenge" | "codeChallengeMethod" | "state" | "agentKey" | "label">): Record<string, unknown>;
export declare function parseCliOAuthAuthorizeCodeResponse(input: unknown): CliOAuthAuthorizeCodeResponse;
export declare function serializeCliOAuthAuthorizeCodeResponse(input: CliOAuthAuthorizeCodeResponse): Record<string, unknown>;
export declare function parseCliOAuthTokenRequestBody(input: unknown): CliOAuthTokenRequestBody;
export declare function serializeCliOAuthTokenRequestBody(input: CliOAuthTokenRequestBody): Record<string, unknown>;
export declare function parseCliOAuthTokenResponse(input: unknown): CliOAuthTokenResponse;
export declare function serializeCliOAuthTokenResponse(input: {
    accessToken: string;
    expiresIn: number;
    refreshToken: string;
    scope: string;
    sessionId: string;
    canWrite?: boolean;
}): Record<string, unknown>;
export declare function parseCliOAuthErrorResponse(input: unknown): CliOAuthErrorResponse;
export declare function readCliOAuthErrorResponse(input: unknown): CliOAuthErrorResponse | null;
export declare function serializeCliOAuthErrorResponse(input: CliOAuthErrorResponse): Record<string, unknown>;
export {};