/**
 * strategies/browserChoice — `oidc-token` WITH browser sign-in, built from
 * config. PENDING INDEPENDENT REVIEW before a company install.
 *
 * Browser sign-in is on when any of its keys is set, and then all of the three
 * it cannot work without are required, together or not at all: the public URL,
 * the client id, and ONE client credential (a private key file, preferred, or a
 * secret file). A half-configured sign-in is not a smaller sign-in.
 *
 * The boot refusals that come with it:
 *  - `IDENTITY_AUDIENCE` equal to `IDENTITY_CLIENT_ID` (design §5.3): an ID
 *    token's `aud` is the client id, so with one value for both an ID token
 *    would pass the API door as an access token;
 *  - door hardening (H1/H4): the door guard is built from the host's own lists
 *    (`boot.crossSite`), and the public URL must pass them;
 *  - `IDENTITY_PKCE` other than `required` or `off`;
 *  - an unreadable key, secret or cookie-key file (named, never printed);
 *  - a sign-in that could never work (review idI57 S-1), found by the
 *    strategy's `ready()`: `openid-client` not installed, a client key that is
 *    not RSA / EC P-256, a discovery document with no authorization or token
 *    endpoint, or PKCE required and `S256` not offered. An IdP that is merely
 *    unreachable at boot is NOT refused — the first login tries again.
 */
/// <reference types="node" />
/// <reference types="node" />
import { type SignInDoor } from '../../../hosting/signin/door.js';
import type { OidcIdentity } from '../oidc.js';
import { type OidcClientCredential } from '../oidcSignIn.js';
import { type IdentityConfig } from './config.js';
import type { IdentityBootOptions } from './choose.js';
/** The settings browser sign-in needs, read and checked. */
export interface BrowserSettings {
    readonly publicUrl: string;
    readonly clientId: string;
    readonly credential: OidcClientCredential;
    readonly scope: string;
    readonly pkce: 'required' | 'off';
    readonly cookieKey?: Buffer;
}
/** `undefined` when browser sign-in is off (token-only); else its checked settings. */
export declare function browserSettings(config: IdentityConfig): BrowserSettings | undefined;
/** The sign-in door for `oidc-token` browser sign-in, refused at boot if it could never work. */
export declare function browserDoor(browser: BrowserSettings, config: IdentityConfig, boot: IdentityBootOptions, production: boolean, verifier: OidcIdentity): Promise<SignInDoor>;