import * as CRYPTO from 'node:crypto';
import { type NetworkOptions, type Session } from './atproto.ts';
/** Write access to attestations, and nothing else. */
export declare const SCOPE = "atproto repo:com.pipobscure.bundle.attestation";
/** What a server that predates granular scopes is asked for instead. */
export declare const FALLBACK_SCOPE = "atproto transition:generic";
export interface OAuthOptions extends NetworkOptions {
    log?: ((line: string) => void) | undefined;
    /** How the authorization URL is opened (default: the system browser). For tests. */
    open?: ((url: string) => void) | undefined;
    /**
     * What to ask for (default: `SCOPE`, attestations only). A server that
     * refuses a granular scope is asked for `FALLBACK_SCOPE` instead.
     */
    scope?: string | undefined;
}
/**
 * Sign in as `identifier` (a handle or a DID), through the browser. The
 * session is good for this process only: call its `end()` when done, which
 * revokes it.
 */
export declare function oauthLogin(identifier: string, options?: OAuthOptions): Promise<Session>;
/**
 * The OAuth client this CLI is. `BUNDLE_OAUTH_CLIENT_ID` names a hosted client
 * metadata document (a public, `native` client whose redirect URIs include
 * `http://127.0.0.1/callback`); without one, it is atproto's loopback
 * development client, whose `client_id` carries its own redirect URI and scope.
 */
export declare function clientIdFor(scope: string): string;
/** A DPoP proof: a JWT signed with the session key, for one request. */
export declare function dpopProof(dpop: CRYPTO.KeyObject, method: string, url: string, nonce?: string | undefined, accessToken?: string | undefined): string;
//# sourceMappingURL=oauth.d.ts.map