import type { CompanyClient, SignInResult } from './company.js';
export type SignInType = 'direct' | 'device' | 'mediated';
/** The sign-in types this Company offers that can grant every requested scope (4.4). */
export declare function eligibleSignInTypes(company: CompanyClient, scope: string): SignInType[];
export interface PendingDirectSignIn {
    url: string;
    state: string;
    codeVerifier: string;
    redirectUri: string;
    scope: string;
    issuer: string;
}
/** Step 1 of 4.5: PKCE (S256) + random `state`, and the authorization URL to open. */
export declare function startDirectSignIn(company: CompanyClient, scope: string): Promise<PendingDirectSignIn>;
/**
 * Steps 3–4 of 4.5: checks `state` and the RFC 9207 `iss` (exact match with the issuer we
 * started with), then exchanges the code with PKCE, DPoP and `session_id`.
 */
export declare function completeDirectSignIn(company: CompanyClient, pending: PendingDirectSignIn, callback: URLSearchParams): Promise<SignInResult>;
export interface DeviceSignInOptions {
    /** Shows the link and code to the User. `device_code` is never passed here. */
    display: (info: {
        userCode: string;
        verificationUri: string;
        verificationUriComplete?: string | undefined;
        expiresIn: number;
    }) => void;
    signal?: AbortSignal | undefined;
    /** Hook for tests. */
    sleep?: ((ms: number, signal?: AbortSignal) => Promise<void>) | undefined;
    onPoll?: ((status: 'authorization_pending' | 'slow_down', intervalSeconds: number) => void) | undefined;
}
/** RFC 8628 device flow: start, show the code, poll every `interval`, +5s on `slow_down`. */
export declare function deviceSignIn(company: CompanyClient, scope: string, opts: DeviceSignInOptions): Promise<SignInResult>;
/**
 * One device-code exchange (4.6), for a server that cannot hold a polling loop open (the user
 * comes back and says "approved"): `'pending'` while the User has not decided, the sign-in when
 * they approved. `access_denied` / `expired_token` throw.
 */
export declare function pollDeviceSignInOnce(company: CompanyClient, deviceCode: string, scope: string): Promise<SignInResult | 'pending'>;
export type MediatedOutcome = {
    status: 'complete';
    result: SignInResult;
} | {
    status: 'code_required';
    signInId: string;
    sentTo?: string | undefined;
    expiresAt?: string | undefined;
} | {
    status: 'failed' | 'expired';
};
/**
 * Mediated Sign-In (4.7). Credentials go ONLY to `auth.mediated.endpoint`, with the current
 * Session Token. Secret values are never logged or echoed by this module.
 */
export declare function mediatedSignIn(company: CompanyClient, scope: string, credentials: Record<string, string>): Promise<MediatedOutcome>;
/** Submits only the one-time code, to `{endpoint}/{sign_in_id}` (4.7). */
export declare function submitMediatedCode(company: CompanyClient, scope: string, signInId: string, code: string): Promise<MediatedOutcome>;
//# sourceMappingURL=signin.d.ts.map