import type { AccessServiceToken } from "./access-probe";
import { type ClaudeFlagValues, type PermissionMode } from "./claude-flags";
import { type FeatureFlagValues } from "./feature-flags";
export declare function generateApiKey(): string;
export declare function validateApiKey(provided: string, expected: string): boolean;
export declare function loadOrCreateApiKey(): string;
export declare function loadBrowseRoot(): string | undefined;
export declare function loadPublicUrl(): string | undefined;
export declare function loadBrowserCors(): string | undefined;
export declare function loadCacheDir(): string | undefined;
export declare function loadTailSize(): number | undefined;
export declare function loadPtyGracePeriodMs(): number | undefined;
export declare function loadDefaultPermissionMode(): PermissionMode | undefined;
export declare function setDefaultPermissionMode(mode: PermissionMode): void;
/**
 * Whether interrupted sessions are re-started automatically at boot
 * (persistence plan Phase 7a).
 *
 * **Tri-state on purpose.** `undefined` means the key is absent — the user has
 * never been asked — and is what triggers the one-time prompt. It is not the
 * same as `false`, which is a real answer and must never be re-asked.
 * Collapsing the two would either nag on every boot or silently decide for
 * someone who was never given the choice.
 *
 * Not a feature flag: feature flags gate behaviour *we* are unsure about, while
 * this is a user preference with a persisted answer — the
 * `default_permission_mode` shape, not the `codexSystemPrompt` shape.
 */
export declare function loadAutoResumeOnBoot(): boolean | undefined;
export declare function setAutoResumeOnBoot(value: boolean): void;
/**
 * Allowlisted Claude CLI flags, stored as ONE line of JSON:
 *
 *     claude_flags: {"permissionMode":"bypassPermissions","addDir":["/srv/a b"]}
 *
 * JSON rather than a bespoke encoding because JSON.stringify already escapes
 * colons, quotes and spaces (killing the whole quoting-bug class) and emits no
 * raw newlines, so the one-line invariant holds by construction. It is also a
 * valid YAML flow mapping, so the file still parses if a real YAML reader is
 * ever pointed at it.
 *
 * A malformed line yields {} plus a warning rather than throwing: server.yaml is
 * hand-editable and a typo must never stop the server from booting.
 */
export declare function loadClaudeFlags(): ClaudeFlagValues;
export declare function setClaudeFlags(values: ClaudeFlagValues): void;
/** Free-text argv appended after the allowlisted flags. Unvalidated by design. */
export declare function loadClaudeExtraArgs(): string | undefined;
/**
 * Throws on an embedded newline rather than silently sanitizing: a newline would
 * corrupt the flat one-line-per-key file, and the caller (the HTTP layer) should
 * surface that to the user as a validation error instead of quietly rewriting
 * what they typed.
 */
export declare function setClaudeExtraArgs(text: string | undefined): void;
/**
 * Server feature flags, stored as ONE line of JSON — same encoding and the same
 * reasons as claude_flags above:
 *
 *     feature_flags: {"codexSystemPrompt":true}
 *
 * Keys must match `FEATURE_FLAGS` object keys (`ptyHost`), not env var names
 * (`THREADBASE_FEATURE_PTY_HOST`). Unknown keys are dropped.
 *
 * Read-only from this module's perspective: nothing writes this key, because
 * flags resolve at boot and there is no runtime-mutation endpoint. Add a
 * setFeatureFlags() alongside a PUT, if one is ever added.
 *
 * A malformed line yields {} plus a warning rather than throwing, so a typo in a
 * hand-edited server.yaml costs the flag, not the boot.
 */
/**
 * Cloudflare Access service-token credentials, for the boot probe in
 * `access-probe.ts`.
 *
 * One line, JSON, so it reads the same way `feature_flags:` does:
 *
 *     access_service_token: {"client_id":"…","client_secret":"…"}
 *
 * A credential in server.yaml is a real consideration, and the file is already
 * `chmod 600` because it holds the API key. This is the operator's own token for
 * their own edge, it is useless without the hostname it belongs to, and the
 * alternative — the streamer holding it in memory only — cannot survive the
 * restart that the probe runs on.
 *
 * A malformed line costs the probe's second half, not the boot: the gate is
 * still detected and reported, just without the "does my token satisfy it"
 * answer.
 */
export declare function loadAccessServiceToken(): AccessServiceToken | undefined;
export declare function loadFeatureFlags(): FeatureFlagValues;
export type PublicUrlValidation = {
    ok: true;
    normalized: string;
} | {
    ok: false;
    error: string;
};
export declare function validatePublicUrl(raw: string): PublicUrlValidation;
export declare function setApiKey(key: string): void;
//# sourceMappingURL=auth.d.ts.map