import { ISignInFailureInvokeActivity, ISignInTokenExchangeInvokeActivity, ISignInVerifyStateInvokeActivity } from '@microsoft/teams.api';
import { Client as HttpClient, EventEmitter } from '@microsoft/teams.common';
import * as contexts from '../contexts';
import { AppEvents, IPlugin } from '../types';
import { PluginAdditionalContext } from '../types/app-routing';
import { OAuthFlow } from '.';
/**
 * Default handlers for the SSO sign-in invoke activities
 * (`signin/tokenExchange`, `signin/verifyState`, `signin/failure`).
 *
 * Previously a set of `this: App`-bound free functions; now a collaborator the
 * {@link App} constructs and registers as system routes. The handlers are arrow
 * class fields so they can be passed directly as route callbacks.
 */
export declare class OauthHandlers<TPlugin extends IPlugin = IPlugin> {
    private readonly getFlows;
    private readonly client;
    private readonly events;
    private readonly graphBaseUrl?;
    private readonly usesRegisteredFlows;
    constructor(getFlows: () => readonly OAuthFlow<TPlugin>[], client: HttpClient, events: EventEmitter<AppEvents<TPlugin>>, graphBaseUrl?: string | undefined, usesRegisteredFlows?: () => boolean);
    onTokenExchange: (ctx: contexts.IActivityContext<ISignInTokenExchangeInvokeActivity, PluginAdditionalContext<TPlugin>>) => Promise<import("@microsoft/teams.api").InvokeResponse<"signin/tokenExchange">>;
    onVerifyState: (ctx: contexts.IActivityContext<ISignInVerifyStateInvokeActivity, PluginAdditionalContext<TPlugin>>) => Promise<import("@microsoft/teams.api").InvokeResponse<"signin/verifyState">>;
    /**
     * Default handler for signin/failure invoke activities.
     *
     * Teams sends a signin/failure invoke when SSO token exchange fails
     * (e.g., due to a misconfigured Entra app registration). This handler
     * logs the failure details and emits an error event so developers are
     * notified rather than having the failure silently swallowed.
     *
     * Known failure codes (sent by the Teams client):
     * - `installappfailed`: Failed to install the app in the user's personal scope (non-silent).
     * - `authrequestfailed`: The SSO auth request failed after app installation (non-silent).
     * - `installedappnotfound`: The bot app is not installed for the user or group chat.
     * - `invokeerror`: A generic error occurred during the SSO invoke flow.
     * - `resourcematchfailed`: The token exchange resource URI on the OAuthCard does not
     *   match the Application ID URI in the Entra app registration's "Expose an API" section.
     * - `oauthcardnotvalid`: The bot's OAuthCard could not be parsed.
     * - `tokenmissing`: AAD token acquisition failed.
     * - `userconsentrequired`: The user needs to consent (handled via OAuth card fallback,
     *   does not typically reach the bot).
     * - `interactionrequired`: User interaction is required (handled via OAuth card fallback,
     *   does not typically reach the bot).
     */
    onSignInFailure: (ctx: contexts.IActivityContext<ISignInFailureInvokeActivity, PluginAdditionalContext<TPlugin>>) => Promise<{
        status: number;
    }>;
    private findFlow;
    private applyUserToken;
    private completeSignIn;
    private getOrderedFlows;
}