/**
 * hosting/signin/source — the lifetimes, applied in ONE place.
 *
 * `signInSource` turns a {@link SignInStore} (which only keeps records) into a
 * {@link SignInSource} (which answers "who is behind this key, right now?").
 * A sign-in is live while BOTH clocks allow it:
 *
 *  - the absolute lifetime (`SignIn.expiresAt`, fixed when it was created —
 *    8 hours by default at the sign-in door), and
 *  - the idle limit (`idleMinutes` since `SignIn.lastSeenAt`) — 30 minutes
 *    under an SSO strategy, where signing in again is silent, and 60 under a
 *    password strategy, where it means retyping.
 *
 * A sign-in found past either clock is DELETED and reported ended, so the next
 * request does not find it either and an open socket carrying it closes. The
 * honest costs, stated rather than implied: a person disabled at the IdP keeps
 * access until their sign-in ends, and their roles are frozen at sign-in for
 * the same time — the library does not poll the IdP.
 */
import type { SignIn, SignInSource, SignInStore } from './types.js';
export interface SignInSourceOptions {
    /** Where sign-ins are kept. */
    readonly store: SignInStore;
    /** Minutes of inactivity after which a sign-in ends. */
    readonly idleMinutes: number;
    /** The clock, epoch ms. Default `Date.now`. */
    readonly now?: () => number;
    /**
     * Told when `identify` FINDS a sign-in past a clock and ends it — which
     * clock, and the row (its identity and strategy; the row holds no secret).
     * The sign-in door's audit trail uses it. A listener that throws is ignored.
     */
    readonly onExpired?: (signIn: SignIn, why: 'lifetime' | 'idle') => void;
}
/** A {@link SignInSource} that can also END a sign-in (sign-out). */
export interface SignIns extends SignInSource {
    onEnd(listener: (key: string) => void): () => void;
    /** End a sign-in now: delete it and tell every `onEnd` listener. Idempotent. */
    end(key: string): Promise<void>;
}
export declare function signInSource(options: SignInSourceOptions): SignIns;