import type { Endpoint } from 'payload';
/**
 * AI-agent (MCP) authentication for the bundled Nitrogen MCP server.
 *
 * Port of the WordPress connector's `Agent_Auth` (includes/agent-auth.php). The
 * cloud MCP server never trusts its caller's claimed identity; for each MCP
 * session it POSTs the user's agent credential to `/agent/verify` and binds the
 * session to the verified `{ userId, host }`.
 *
 * Credential format: `<userId>:<secret>` (Bearer). We persist only a salted
 * scrypt hash of `<secret>` on the user, looked up by `<userId>` — so a single
 * hash check verifies it without scanning every user. Each editor mints their
 * own from their profile screen; the plaintext is shown exactly once.
 */
/** Generate a url-safe credential secret. */
export declare function generateSecret(): Promise<string>;
/**
 * Hash a secret with a random salt using scrypt. Returns `salt:hash` (both hex).
 */
export declare function hashSecret(secret: string): Promise<string>;
/**
 * Verify a secret against a stored `salt:hash`. Constant-time comparison.
 * Returns false on any malformed input; never throws.
 */
export declare function verifySecret(secret: string, stored: string): Promise<boolean>;
/**
 * Build the four agent-auth endpoints bound to a given user collection slug.
 * The user collection must have fields `nitrogenAgentTokenHash` (text) and
 * `nitrogenAgentTokenCreated` (number).
 */
export declare function createAgentAuthEndpoints(userCollection: string): Endpoint[];