import { Challenge as MppxChallenge } from 'mppx';
/** Re-exported challenge type, identical to mppx's. */
export type Challenge<request = Record<string, unknown>, intent extends string = string, method extends string = string> = MppxChallenge.Challenge<request, intent, method>;
/**
 * Maximum accepted `WWW-Authenticate` challenge header length (audit #9).
 *
 * mppx@0.5.x base64-decodes + JSON-parses the embedded `request` parameter with
 * no size cap, so an oversized header drives proportionally larger decode/parse
 * work — a client-side DoS surface. Until a cap lands upstream, we guard the
 * full header at OUR `@solana/mpp` boundary, mirroring the existing empty-id
 * guard. 16 KiB matches the `MAX_TOKEN_LEN` the canonical credential/receipt
 * parsers already enforce.
 */
export declare const MAX_CHALLENGE_HEADER_LEN: number;
/**
 * Deserializes a `WWW-Authenticate` header value to a challenge, rejecting a
 * challenge whose `id` is empty (canonical mpp-tools requires a non-empty,
 * HMAC-bound id). Otherwise identical to `mppx`'s `Challenge.deserialize`.
 */
export declare const deserialize: typeof MppxChallenge.deserialize;
/**
 * Deserializes a `WWW-Authenticate` header value that may contain multiple
 * challenges, rejecting any challenge whose `id` is empty.
 */
export declare const deserializeList: typeof MppxChallenge.deserializeList;
/**
 * The `Challenge` namespace as exposed by `@solana/mpp`: the upstream `mppx`
 * surface with the empty-id parse guard applied to the header-parsing entry
 * points. Use this instead of importing `Challenge` directly from `mppx` when
 * canonical-conformant parsing is required.
 */
export declare const Challenge: typeof MppxChallenge;
//# sourceMappingURL=challenge-guard.d.ts.map