/**
 * Dashboard token primitives.
 *
 * The Cortex dashboard authenticates browser sessions with single-use
 * raw tokens generated by `cortex dashboard create-token`. The CLI
 * stores only the Argon2id hash on disk (per-workspace `.env`) under
 * `PRZM_CORTEX_DASHBOARD_TOKEN_HASH_<LABEL>=<hash>`. The raw token is
 * shown to the user exactly once and never persisted server-side.
 *
 * Tokens are 32 random bytes hex-encoded — 256 bits of entropy, plenty
 * for offline brute-force resistance even before the Argon2id layer
 * kicks in. Argon2id is the OWASP-recommended default for new code.
 *
 * Why per-label hashes (not a single one): the operator may want one
 * token per browser / device / agent, with the ability to rotate or
 * revoke individually without invalidating every other browser that's
 * already logged in.
 */
/** Per-token env-key prefix. Scanned by `findTokenHashes`. */
export declare const DASHBOARD_TOKEN_HASH_PREFIX = "PRZM_CORTEX_DASHBOARD_TOKEN_HASH_";
/**
 * Generate a fresh raw token. 256 bits of entropy, hex-encoded so the
 * operator can copy-paste it from a terminal without shell-escape
 * surprises.
 */
export declare function generateRawToken(): string;
/**
 * Hash a raw token with Argon2id at sensible defaults (the library's
 * built-in baseline — memory=19MiB, time=2, parallelism=1). The result
 * is a fully self-describing PHC string, so the parameters travel with
 * the hash and we can tune them later without breaking existing tokens.
 */
export declare function hashToken(raw: string): Promise<string>;
/**
 * Constant-time verification. Library-level errors (malformed hash,
 * truncated input, etc.) are swallowed and reported as a normal
 * verification failure so the caller never has to distinguish "wrong
 * token" from "bad hash on disk" — both mean "do not authenticate".
 */
export declare function verifyToken(raw: string, storedHash: string): Promise<boolean>;
/**
 * Compute the .env key for a token label.
 *
 *   "default"           → PRZM_CORTEX_DASHBOARD_TOKEN_HASH_DEFAULT
 *   "my browser"        → PRZM_CORTEX_DASHBOARD_TOKEN_HASH_MY_BROWSER
 *   "ci-runner"         → PRZM_CORTEX_DASHBOARD_TOKEN_HASH_CI_RUNNER
 *
 * Non-alphanumeric characters collapse to `_` so the resulting string
 * is always a legal shell env-var name. Empty labels are rejected to
 * avoid the ambiguous `PRZM_CORTEX_DASHBOARD_TOKEN_HASH_=...` row.
 */
export declare function envKeyForLabel(label: string): string;
/**
 * Inverse of `envKeyForLabel`: recover the label portion of a key. We
 * only have a normalized form (uppercase, underscores) — there's no way
 * to reconstruct the operator's original casing or spacing — but the
 * normalized form is what we show in `list-tokens` and what
 * `requireDashboardAuth` records onto the session for the `whoami` UI.
 */
export declare function labelForEnvKey(key: string): string | undefined;
/**
 * Scan a parsed .env map for token hash entries. Returns the label +
 * stored hash for each `PRZM_CORTEX_DASHBOARD_TOKEN_HASH_*` key. Order
 * is insertion order of the underlying map.
 *
 * The caller iterates these to find a match for an incoming raw token.
 */
export declare function findTokenHashes(env: ReadonlyMap<string, string> | Record<string, string | undefined>): Array<{
    label: string;
    hash: string;
}>;
//# sourceMappingURL=dashboard-token.d.ts.map