/**
 * auth-remote — HTTP helper for `olam auth --remote <url>` subcommands.
 *
 * Wraps fetch calls against the auth-worker's `/v1/*` endpoints.
 *
 * V1 dogfood note: CF Access cookie must be obtained manually via browser.
 * A proper CLI-orchestrated SSO flow (CLI-as-OAuth-client) is deferred to v2.
 * See e4/e5/e6 task notes in docs/plans/auth-worker-multitenant-vault/.
 */
export type FetchFn = typeof fetch;
export interface RemoteClientOptions {
    /** Auth-worker base URL, e.g. https://auth.example.workers.dev */
    baseUrl: string;
    /** CF_Authorization cookie value, obtained manually from browser DevTools. */
    cfAuthCookie?: string;
    /**
     * CF Access service-token client id (Phase H h2). When both this and
     * cfAccessClientSecret are present, the request authenticates machine-to-
     * machine via CF-Access-Client-Id / CF-Access-Client-Secret headers — no
     * cookie-paste needed. The Cloudflare edge mints the SSO JWT.
     */
    cfAccessClientId?: string;
    /** CF Access service-token client secret (paired with cfAccessClientId). */
    cfAccessClientSecret?: string;
    /** Injected fetch for testing. Defaults to global fetch. */
    fetchFn?: FetchFn;
}
export interface ServiceToken {
    client_id: string;
    label: string;
    created_at?: string;
}
export interface AccountEntry {
    id: string;
    label?: string;
    state?: string;
    expiresIn?: string;
}
export interface AnthropicTokenIssueResponse {
    secret: string;
    token_hash: string;
    label: string;
    anthropic_base_url_hint?: string;
}
export interface AnthropicTokenEntry {
    token_hash: string;
    label: string;
    issued_at?: string;
    created_at?: string;
    last_used_at?: string;
}
export interface OAuthStartResponse {
    authorize_url: string;
    state_id: string;
}
export interface HealthResponse {
    status: string;
    version?: string;
}
export interface DoctorCheckResult {
    probe: string;
    status: 'pass' | 'fail' | 'warn';
    message: string;
    remedy?: string;
}
/**
 * GET /v1/health — worker liveness probe.
 */
export declare function remoteHealth(opts: RemoteClientOptions): Promise<HealthResponse>;
/**
 * POST /v1/oauth/start — begin an OAuth flow.
 * Returns { authorize_url, state_id }.
 */
export declare function remoteOAuthStart(opts: RemoteClientOptions): Promise<OAuthStartResponse>;
/**
 * GET /v1/service-tokens — list bound service tokens.
 */
export declare function remoteListServiceTokens(opts: RemoteClientOptions): Promise<ServiceToken[]>;
/**
 * GET /v1/accounts — list registered accounts (Anthropic OAuth sessions).
 */
export declare function remoteListAccounts(opts: RemoteClientOptions): Promise<AccountEntry[]>;
/**
 * POST /v1/service-tokens/bind — bind a CF service token to a user sub.
 */
export declare function remoteBindServiceToken(opts: RemoteClientOptions, payload: {
    client_id: string;
    label: string;
}): Promise<{
    ok: boolean;
}>;
/**
 * DELETE /v1/service-tokens/:client_id — revoke a service token.
 */
export declare function remoteDeleteServiceToken(opts: RemoteClientOptions, clientId: string): Promise<{
    ok: boolean;
}>;
/**
 * POST /v1/anthropic-tokens/issue — mint a new Anthropic proxy token.
 * Returns { secret, token_hash, label, anthropic_base_url_hint }.
 */
export declare function remoteIssueAnthropicToken(opts: RemoteClientOptions, label: string): Promise<AnthropicTokenIssueResponse>;
/**
 * GET /v1/anthropic-tokens — list issued Anthropic proxy tokens.
 */
export declare function remoteListAnthropicTokens(opts: RemoteClientOptions): Promise<AnthropicTokenEntry[]>;
/**
 * DELETE /v1/anthropic-tokens/:token_hash — revoke an Anthropic proxy token.
 * Returns true on 200/204, false on 404.
 */
export declare function remoteRevokeAnthropicToken(opts: RemoteClientOptions, tokenHash: string): Promise<boolean>;
/**
 * runDoctorChecks — runs 4 diagnostic probes against the auth-worker.
 * Returns an ordered array of DoctorCheckResult (pass/fail/warn + remedy).
 *
 * Probe 1: GET /v1/health → liveness
 * Probe 2: CF Access JWKS reachable (derives team domain from worker URL)
 * Probe 3: POST /v1/oauth/start → endpoint reachability
 * Probe 4: ANTHROPIC_OAUTH_CLIENT_ID env present (config check)
 */
export declare function runDoctorChecks(opts: RemoteClientOptions): Promise<DoctorCheckResult[]>;
//# sourceMappingURL=auth-remote.d.ts.map