/**
 * Default client for the Vana Account access-request API.
 *
 * @remarks
 * Calls the Vana Account endpoints that issue `dcr_*` ids and approval URLs and
 * report request status. Inject a custom {@link AccessRequestClient} on the
 * controller to point at a different deployment; pass `fetchFn` to supply a test
 * double for the HTTP layer.
 *
 * @category Direct
 * @module direct/access-request-client
 */
import type { AccessRequestClient, AccessRequestQuestion, DirectEnv } from "./types.js";
import type { Web3SignedSignFn } from "../auth/web3-signed-builder.js";
/** Minimal `fetch` signature so the client is testable without a global fetch. */
export type FetchLike = (input: string, init?: {
    method?: string;
    headers?: Record<string, string>;
    body?: string;
}) => Promise<{
    ok: boolean;
    status: number;
    statusText: string;
    json(): Promise<unknown>;
    text(): Promise<string>;
}>;
/** Options for {@link createDefaultAccessRequestClient}. */
export interface DefaultAccessRequestClientOptions {
    /** Base URL of the Vana Account access-request API. */
    baseUrl: string;
    /** Base URL the user is sent to for approval. */
    approvalBaseUrl: string;
    /**
     * Target environment. Pins the allowed mobile continuation link host
     * (`open.vana.org` for production, `open-dev.vana.org` for dev). When omitted,
     * both canonical hosts pass the structural continuation-URL check.
     */
    env?: DirectEnv;
    /** `fetch` implementation. Defaults to the global `fetch`. */
    fetchFn?: FetchLike;
    /** App identity address used for direct access-request authentication. */
    appAddress?: string;
    /** EIP-191 signer for direct access-request authentication. */
    signMessage?: Web3SignedSignFn;
    /** Clock source used for signed request timestamps. */
    now?: () => number;
    /**
     * Create the signed DCR idempotency key used when a create call omits one.
     * Called once per create. Injectable for deterministic tests.
     */
    createIdempotencyKey?: () => string;
}
interface DirectAccessRequestAuthInput {
    body: string;
    method: string;
    path: string;
    timestamp: string;
}
export declare function buildDirectAccessRequestAuthMessage(input: DirectAccessRequestAuthInput): string;
/**
 * Build an approval URL for a request id, matching the documented format
 * (`{app}/data-connection-requests/{requestId}?mode=page`).
 *
 * @param approvalBaseUrl - Base URL of the Vana approval app.
 * @param requestId - The `dcr_*` request id.
 * @returns The full approval URL.
 */
export declare function buildApprovalUrl(approvalBaseUrl: string, requestId: string): string;
/**
 * Validate the derivative questions on a create input against the request
 * scope entries.
 *
 * @remarks
 * Client-side mirror of the access-request service rules so builders fail
 * fast, before the create request is signed and sent; the service remains
 * authoritative. Rules: 1 to 4 questions; every `derivedScope` and every
 * `sourceScope` is a concrete scope (wildcards rejected); 1 to 16 source
 * scopes per question with no duplicates and none equal to the derived scope;
 * the first dot-segment of the derived scope differs from the first
 * dot-segment of every source scope; the derived scope appears verbatim in
 * `scopes` as a bare read entry; no two questions share a derived scope; the
 * question text is 1 to 4000 characters after trimming; `recompute`, when
 * present, is `"snapshot"` or `"on-change"`.
 *
 * @param questions - The `questions` array from the create input.
 * @param scopes - The request's grant scope entries, verbatim.
 * @throws {DirectConfigError} - When any rule is violated. The message names
 * the offending question index and field.
 */
export declare function validateAccessRequestQuestions(questions: readonly AccessRequestQuestion[], scopes: readonly string[]): void;
/**
 * Create the default {@link AccessRequestClient} for the Vana Account
 * access-request API.
 *
 * @param options - Base URLs and an optional `fetch` implementation.
 * @returns An {@link AccessRequestClient} backed by HTTP calls.
 */
export declare function createDefaultAccessRequestClient(options: DefaultAccessRequestClientOptions): AccessRequestClient;
export {};