/**
 * Split-PKCE provisioning — minting a resident credential without ever holding
 * one.
 *
 * The earlier design had the lender complete an authorization and hand the
 * borrower a file containing a live access token and a refresh token. That file
 * is copyable, re-sharable, and exists on disk in plaintext at both ends for as
 * long as anyone forgets to delete it. Nothing about the lease constrains a
 * credential someone else already copied.
 *
 * This splits the flow along the seam PKCE was designed for:
 *
 * 1. The **borrower** generates a verifier and sends only its SHA-256
 *    challenge, over its authenticated grant.
 * 2. The **lender** authorizes in their own browser, against their own account,
 *    with the borrower's challenge in the URL.
 * 3. The **authorization code** comes back to the lender and is relayed to the
 *    borrower.
 * 4. The **borrower** exchanges code + verifier for tokens, on its own machine.
 *
 * The code is worthless to anyone who intercepts it: the token endpoint will not
 * exchange it without the verifier, which never left the borrower. The lender
 * never possesses a token for the credential it just authorized, so there is
 * nothing for it to leak, re-send, or forget to delete.
 *
 * **What this module owns** is the lender's side of that conversation: the
 * pending request, its binding to one grant, its expiry, and the rule that a
 * code is handed over exactly once.
 *
 * @module proxy/shareProvisioning
 */
import type { ProxyShareProvisionOutcome, ProxyShareProvisionRequest } from "../types/index.js";
/**
 * How long a challenge stays claimable.
 *
 * Long enough for a lender to notice a request and finish a browser login,
 * short enough that a challenge left lying around is not a standing invitation.
 */
export declare const PROVISION_REQUEST_TTL_MS = 900000;
export declare function initShareProvisioning(filePath: string): void;
/**
 * Narrow an open/authorize outcome to its failing half.
 *
 * One of the package's build steps compiles without `strictNullChecks`, where a
 * boolean discriminant does not narrow. Callers reading `.reason` need this.
 */
export declare function isProvisionFailure(outcome: ProxyShareProvisionOutcome): outcome is {
    ok: false;
    reason: string;
};
/** Is this request still live? Expiry and consumption both retire it. */
export declare function isProvisionRequestOpen(request: ProxyShareProvisionRequest, now?: number): boolean;
/**
 * Record a borrower's challenge.
 *
 * One open request per grant: a second one replaces the first rather than
 * queueing, because the borrower that just asked is the one waiting, and an
 * abandoned challenge should not be claimable later by whoever finds it.
 *
 * Rejects anything that is not a well-formed S256 challenge. The lender is about
 * to put this string into an authorization URL against its own account, so it
 * is not the place to be relaxed about input.
 */
export declare function openProvisionRequest(args: {
    grantId: string;
    codeChallenge: string;
    state: string;
    now?: number;
}): Promise<ProxyShareProvisionOutcome>;
/** The open request for a grant, if there is one. */
export declare function getProvisionRequest(grantId: string, now?: number): Promise<ProxyShareProvisionRequest | undefined>;
/** Every open request, for a lender deciding which to authorize. */
export declare function listProvisionRequests(now?: number): Promise<ProxyShareProvisionRequest[]>;
/**
 * Attach the authorization code the lender's browser produced.
 *
 * The code is bound to the grant that asked for it and to the account the lender
 * authorized against — the same account the drift audit will later reconcile —
 * so a code cannot be redirected to a different grant after the fact.
 */
export declare function authorizeProvisionRequest(args: {
    grantId: string;
    code: string;
    accountLabel?: string;
    now?: number;
}): Promise<ProxyShareProvisionOutcome>;
/**
 * Hand the code to the borrower — once.
 *
 * Single-use is the whole binding: an authorization code that could be claimed
 * twice would let anyone who replayed the call mint a second credential on the
 * lender's account. Consumption is recorded before the value is returned.
 */
export declare function claimProvisionRequest(grantId: string, now?: number): Promise<{
    status: "ready";
    code: string;
    state: string;
} | {
    status: "pending";
} | {
    status: "none";
}>;
/** Drop a grant's request — used when the grant itself goes away. */
export declare function clearProvisionRequest(grantId: string): Promise<void>;
/**
 * A state value for a borrower to send alongside its challenge.
 *
 * Kept here so both ends agree on the shape `STATE_PATTERN` will accept.
 */
export declare function generateProvisionState(): string;