/**
 * Finish a Clerk Authorize click without the browser reaching localhost.
 *
 * Organic SKILL.md / Cursor / Claude Desktop hosts often kill `auth login`
 * (tool timeout) or cannot route https://apiclaw.cloud → http://127.0.0.1.
 * Authorize still claims the authId in Convex. whoami and a live login
 * poll that claim with the PKCE challenge from ~/.apiclaw/pending-login
 * and exchange it for session_token. The one-time code is useless without
 * the verifier that never left this machine.
 */
import type { AuthConfig } from "./auth-config.js";
export declare const CLI_AUTH_POLL_PATH = "cliAuth:poll";
export declare const CLI_AUTH_EXCHANGE_PATH = "cliAuth:exchange";
export type PendingLogin = {
    browserUrl: string;
    authId: string;
    codeVerifier: string;
    state: string;
    fingerprint?: string;
    startedAt: number;
    expiresAt?: number;
};
export type ClaimedPoll = {
    status: "claimed";
    code: string;
    state: string;
};
export type CliAuthPollResult = ClaimedPoll | {
    status: "pending" | "exchanged" | "expired" | "not_found";
};
export type RedeemExchangeResult = {
    success: boolean;
    error?: string;
    sessionToken?: string;
    workspaceId?: string;
    email?: string;
    apiKey?: string;
    tier?: string;
    isNew?: boolean;
};
export declare function pkceChallengeFromVerifier(verifier: string): string;
export declare function pendingLoginStillOpen(pending: PendingLogin | null | undefined, now?: number): pending is PendingLogin;
export declare function claimedCodeFromPoll(pending: PendingLogin, poll: CliAuthPollResult | null | undefined): {
    code: string;
    state: string;
} | null;
export declare function authConfigFromExchange(result: RedeemExchangeResult, now?: number): AuthConfig | null;
export declare function redeemPendingLogin(options: {
    pending: PendingLogin | null;
    poll: (authId: string, challenge: string) => Promise<CliAuthPollResult | null>;
    exchange: (args: {
        code: string;
        codeVerifier: string;
        fingerprint?: string;
    }) => Promise<RedeemExchangeResult>;
    write: (cfg: AuthConfig) => void;
    clearPending: () => void;
    now?: number;
}): Promise<AuthConfig | null>;
//# sourceMappingURL=cli-auth-redeem.d.ts.map