export type CliConfig = {
    /** Public tools API origin (vigilbase.com / apps/com). */
    publicBaseUrl: string;
    /** Authenticated Vigilbase One origin (one.vigilbase.com / apps/one). */
    oneBaseUrl: string;
    /** OAuth client_id for Better Auth device authorization. */
    clientId: string;
    /** Explicit Identity issuer (--auth-url / VIGILBASE_AUTH_URL). One's discovery must name it; unset, only production Identity is trusted. */
    identityBaseUrl?: string;
    authProvider?: import('../auth/provider.js').AuthProvider;
    /**
     * Directory for credentials and local config (~/.config/vigilbase). Not validated when the config is built:
     * the credential store rejects a relative path itself, so commands that never use it work whatever it holds.
     */
    configDir: string;
    userAgent: string;
    timeoutMs: number;
};
/** @deprecated Prefer `publicBaseUrl`. Kept for library callers. */
export type CliConfigLegacy = CliConfig & {
    baseUrl: string;
};
export declare function parseOrigin(raw: string, option: string): string;
/** Default request timeout; also used when library callers omit `timeoutMs`. */
export declare const DEFAULT_TIMEOUT_MS = 60000;
export declare function resolvePublicBaseUrl(explicit?: string | null): string;
export declare function resolveOneBaseUrl(explicit?: string | null): string;
/** Validate at transport boundaries too: library callers may construct config objects. */
export declare function validateOneOrigin(raw: string): string;
/** Production Identity: the only issuer trusted unless --auth-url / VIGILBASE_AUTH_URL names another. */
export declare const DEFAULT_IDENTITY_ISSUER = "https://auth.vigilbase.com";
export declare const STAGING_IDENTITY_ISSUER = "https://identity-staging.vigilbase.com";
export declare function resolveIdentityBaseUrl(raw: string): string;
/**
 * The one Identity issuer this configuration trusts: --auth-url / VIGILBASE_AUTH_URL
 * when set, otherwise production. Staging is trusted only when configured explicitly.
 * Validated here too because library callers may construct config objects.
 */
export declare function trustedIdentityIssuer(config: Pick<CliConfig, 'oneBaseUrl' | 'identityBaseUrl'>): string;
export declare function resolveClientId(explicit?: string | null): string;
/** The config directory, which must be absolute. */
export declare function resolveConfigDir(explicit?: string | null, env?: NodeJS.ProcessEnv): string;
export declare function createConfig(options?: {
    baseUrl?: string | null;
    publicBaseUrl?: string | null;
    oneBaseUrl?: string | null;
    clientId?: string | null;
    identityBaseUrl?: string | null;
    configDir?: string | null;
    timeoutMs?: number;
}): CliConfigLegacy;
/**
 * Config for `vigilbase local …` and `vigilbase cloudflare-checkup`. Local
 * checkups resolve their own submit origin (resolveSubmitOrigin) and never
 * read VIGILBASE_* URLs. They resolve the config directory themselves, and
 * only when they need it (the managed cf install, the default snapshot path),
 * so malformed values cannot block offline commands such as `inspect`.
 */
export declare function createLocalCommandConfig(timeoutMs?: number): CliConfigLegacy;
/** Back-compat helper used by older call sites / tests. */
export declare function resolveBaseUrl(explicit?: string | null): string;