/**
 * hosting/signin/hostSignIn — a host's `signIn` option, judged once at
 * construction, plus the conversation door's per-socket sign-in watch.
 */
import { IdentityNotVerifiedError, VerifierUnavailableError } from '../errors.js';
import { type DoorIdentity } from '../identityVerification.js';
import { type CrossSiteOptions } from '../doorGuard.js';
import { type HostSignInOptions, type SignInSource } from './types.js';
/** The option, defaulted and checked. */
export interface ResolvedHostSignIn {
    readonly cookieName: string;
    readonly identity: DoorIdentity;
}
/** Refuse a half-spelled `signIn` by name, before a socket exists. */
export declare function checkHostSignIn(hostName: string, option: HostSignInOptions | undefined, door?: CrossSiteOptions & {
    readonly bindHost?: string;
}): ResolvedHostSignIn | undefined;
/** Why a handshake is refused before the 101: the status and the error. */
export interface HandshakeRefusal {
    readonly status: 401 | 503;
    readonly error: IdentityNotVerifiedError | VerifierUnavailableError;
}
/**
 * Verify a handshake: the same funnel a request goes through. Resolves the
 * refusal, or `undefined` when the caller is proven.
 */
export declare function checkHandshake(signIn: ResolvedHostSignIn, headers: Readonly<Record<string, string>>, signInKey: string | undefined): Promise<HandshakeRefusal | undefined>;
/**
 * Is the sign-in behind this socket still live? `'live'`, `'ended'`, or
 * `'unknown'` when the store could not answer (the frame is held back either
 * way; an unknown answer closes as an outage, never as a sign-out).
 */
export declare function signInStillLive(source: SignInSource, key: string): Promise<'live' | 'ended' | 'unknown'>;