/**
 * Opens the system default browser for the `ruflo auth login` flow. A
 * TypeScript port of meta-proxy's `src/oauth/browser.rs`.
 *
 * Deliberately does NOT go through `SafeExecutor.execute()`: `SafeExecutor`'s
 * blocked-argument patterns (`safe-executor.ts`'s `DEFAULT_BLOCKED_PATTERNS`)
 * include a bare `&`, which is meant to catch shell-metacharacter injection in
 * command-line-style arguments — but it also appears in every real OAuth
 * authorize URL's query string (`?a=1&b=2&...`), so passing one through would
 * false-positive-reject on every real invocation. That blocklist is the wrong
 * tool for a URL argument: with `shell: false` (used here, same as
 * `SafeExecutor`), a single argv element containing `&` is inert — there's no
 * shell to interpret it. The actual safety property that matters is "the URL
 * was constructed by us from validated components, never from raw external
 * input" (this module's `authorizeUrl()` in `client.ts` is the only caller),
 * which `assertSafeUrl` below checks directly instead.
 *
 * @module v3/security/oauth/browser
 */
/**
 * Attempts to open `url` in the system default browser. Resolves whether or
 * not a browser window actually appeared — this cannot be confirmed in
 * general, which is why the caller always also prints the URL as a fallback.
 */
export declare function openBrowser(url: string): Promise<void>;
/** Pure command selection, exported for platform regression tests. */
export declare function browserCommand(url: string, platform?: NodeJS.Platform): {
    cmd: string;
    args: string[];
};
//# sourceMappingURL=browser.d.ts.map