// Types for client-identity.js (#1303 P2-1) — the hosted Worker imports it from TypeScript.
export interface FirstPartyClient {
  readonly brand: string;
  readonly tokens: readonly string[];
  readonly hosts: readonly string[];
  readonly schemes: readonly string[];
}
export const FIRST_PARTY_CLIENTS: readonly FirstPartyClient[];
export function foldClientName(name: unknown): string;
export function claimedBrand(name: unknown): FirstPartyClient | null;
export interface RegistrationRefusal {
  error: 'invalid_redirect_uri' | 'invalid_client_metadata';
  reason:
    | 'redirect_uri_invalid'
    | 'redirect_uri_not_https'
    | 'redirect_uri_has_userinfo'
    | 'redirect_uri_browser_target_unreadable'
    | 'client_name_hidden_characters'
    | 'client_name_too_long';
  error_description: string;
}
export function registrationRefusal(body: unknown): RegistrationRefusal | null;
/** Why a redirect is refused for carrying a userinfo part (asked at /register AND /authorize), or null. */
export function redirectUserinfoRefusal(redirectUri: unknown): RegistrationRefusal | null;
/** Why a browser-launch redirect is refused because the address it opens cannot be read (#1466), or null. */
export function browserTargetRefusal(redirectUri: unknown): RegistrationRefusal | null;
export const BROWSER_LAUNCH_SCHEMES: readonly string[];
export const CLIENT_NAME_MAX: number;
export const APP_SCHEME_DISPLAY_MAX: number;
export const CLAIMED_TARGET_DISPLAY_MAX: number;
/** No redirect reached the screen (not a string, or empty) — the refusal that may be ours (#1466). */
export function redirectMissing(redirectUri: unknown): boolean;
export function isNameQuoteCodePoint(ch: string): boolean;
export function isForbiddenNameCodePoint(ch: string): boolean;
export function clientNameRefusal(name: unknown): RegistrationRefusal | null;
export function displayClientName(name: unknown): string | null;
// Every field is the parser's reading. `uri` is the full parsed destination (second layer); the app
// branch adds `browser` (a browser-launch scheme), `target` (the web host that browser opens —
// primary line; null for every other scheme) and `claimedTarget` (the host a non-browser scheme's URI
// names — the client's own words, shown one line lower and marked so; null for browser schemes).
export type RedirectDescription = {
  host: string;
  uri: string;
  verified: boolean;
  brand: string | null;
} & ({ kind: 'web' | 'loopback' } | { kind: 'app'; browser: boolean; target: string | null; claimedTarget: string | null });
export function describeRedirect(redirectUri: unknown, clientName: unknown): RedirectDescription | null;
export function refuseRegistration(request: Request): Promise<Response | null>;