/**
 * strategies/directoryChoice — `directory-password` from config: plain Active
 * Directory over LDAPS, for a company with no federation server (design §4.5).
 *
 * Allowed in production (unlike `local-password`) — it is the company's real
 * directory — and the banner says what it costs: a password bind skips
 * whatever MFA the company's single sign-on enforces.
 *
 * Attempt limits come from AD's OWN lockout policy, which the AD admin
 * supplies (review idI57 B-1, B-2, S-4):
 *  - **a THIRD of the threshold per ACCOUNT**, counted under the account the
 *    name reaches (`alice`, `ALICE`, `CORP\alice` and `alice@corp.example` are
 *    one budget), over a window that — like AD's own "reset account lockout
 *    counter after" — restarts from the LAST failure;
 *  - a third, not a half, because one AD account can have TWO logon names the
 *    door cannot tie together without a service account: the UPN prefix and
 *    the sAMAccountName (Jane: `jsmith@corp`, `jsmith2`). Two budgets of
 *    ⌊T/3⌋ still leave AD a third of its threshold for the person's VPN, mail
 *    and typos. The residual: an account with THREE distinct logon names (an
 *    alternative UPN suffix) could reach T through this door alone;
 *  - a threshold of 1 or 2 is REFUSED at boot — no budget of whole attempts
 *    stays under it — unless `IDENTITY_LDAP_ACCEPT_LOW_THRESHOLD=yes`, whose
 *    banner says the door cannot protect those accounts;
 *  - a threshold of 0 means AD never locks; the door keeps its default.
 * This REDUCES lockout risk; it cannot rule it out (AD counts every source).
 * The protection that holds whatever this door does is AD's own: a lockout
 * DURATION of minutes, not "until an admin unlocks", and a threshold of 10 or
 * more (the Microsoft security baseline's number).
 *
 * Trust (`IDENTITY_LDAP_CA_FILE`): a PEM file holding the ROOT CA, or exactly
 * `system` — Node's default CA store, for a DC certificate a public CA issued.
 * Never unset-means-system: an operator who forgot the key is refused, not
 * quietly trusting every public CA. A file holding an INTERMEDIATE boots with
 * a banner warning (it is replaced at renewal; trust the root).
 */
import { type LdaptsBackend } from '../directory/ldapDirectory.js';
import { type IdentityConfig } from './config.js';
import type { IdentityBootOptions, IdentityChoice } from './choose.js';
/** Build the `directory-password` choice, or refuse to boot naming the key. */
export declare function directoryPasswordChoice(config: IdentityConfig, boot: IdentityBootOptions & {
    readonly ldapts?: LdaptsBackend;
}, production: boolean): IdentityChoice;