/**
 * Gate for RFC 7591 Dynamic Client Registration.
 *
 * Public registration is closed. A caller must present an initial access
 * token (RFC 7591 §3) that matches OAUTH_DCR_INITIAL_ACCESS_TOKEN, and every
 * redirect URI must be loopback or on the hosted-client allowlist.
 * Workspace-issued connectors do not use this gate; they are minted by an
 * authenticated dashboard session and bound to that workspace.
 */
export declare const MIN_INITIAL_ACCESS_TOKEN_LENGTH = 32;
/** Exact redirect URIs already used by first-party connector presets. */
export declare const BUILTIN_DCR_REDIRECT_URIS: readonly ["https://grok.com/connectors-oauth/callback", "https://chat.openai.com/connector_callback", "https://chatgpt.com/connector_platform_oauth_redirect"];
export type RegistrationDecision = {
    ok: true;
    initialAccessToken: string;
    redirectUris: string[];
} | {
    ok: false;
    status: 401 | 400;
    error: string;
    error_description: string;
};
export declare function timingSafeEqualString(left: string, right: string): boolean;
export declare function initialAccessTokenMatches(presented: string | undefined, configured: string | undefined): boolean;
export declare function parseBearerToken(authorizationHeader: string | null | undefined): string | null;
/** HTTPS, or HTTP only on a loopback host. No credentials, no fragment. */
export declare function normalizeSafeRedirectUri(uri: string): string | null;
export declare function isAllowlistedDynamicRedirect(uri: string, extraAllowlistRaw: string | undefined): boolean;
/**
 * Decide whether a dynamic registration request may mint credentials.
 * Unauthenticated callers are rejected before redirect policy is applied,
 * so a missing token never becomes a client_id.
 */
export declare function registrationDecision(input: {
    authorizationHeader: string | null;
    configuredToken: string | undefined;
    redirectUris: string[];
    extraAllowlistRaw?: string | undefined;
}): RegistrationDecision;
/**
 * Shared Convex-side gate. Throws before any client row is written when the
 * caller is unauthenticated or the redirect URI is not allowlisted.
 */
export declare function assertCanRegisterDynamicClient(input: {
    presentedToken: string | undefined;
    configuredToken: string | undefined;
    redirectUris: string[];
    extraAllowlistRaw?: string | undefined;
}): {
    redirectUris: string[];
};
//# sourceMappingURL=oauth-dcr.d.ts.map