import { GiteaTokenEntry } from './gitea-token-storage.js';
export interface GiteaTokenResponse {
    expiresAt: string | null;
    repoUrl: string;
    token: string;
    /**
     * Canonical workspace UUID for the minted token. Used as the backend
     * identity in the push identity check — required so the CLI can match a
     * `--workspace <UUID>` request against the canonical workspace row without
     * assuming the slug is also the UUID. Backend returns this alongside
     * `workspaceSlug` as of the Guard 1 rollout in `project/plans/cli-git-sync.md`.
     */
    workspaceId: string;
    /**
     * Human-readable workspace slug (NOT the UUID). Used to pin `quonfig.json`
     * and for identity-check guard messages. Required as of the Guard 1 rollout
     * in `project/plans/cli-git-sync.md`; the backend always returns it.
     */
    workspaceSlug: string;
}
export declare const mintGiteaToken: (workspaceId: string, orgSlug: string, scope: "read" | "write", purpose: "pull" | "bootstrap" | "push") => Promise<GiteaTokenResponse>;
/**
 * Mint a Gitea read token, store it, and return the entry.
 */
export declare const mintAndStoreGiteaReadToken: (workspaceId: string, orgSlug: string) => Promise<GiteaTokenEntry>;