/**
 * @typedef {'web' | 'api'} LoginMode
 *
 * @typedef {Object} LoginConfig
 * @property {ReturnType<import('../oauth.js').createOAuth>} oauth
 * @property {LoginMode} [mode='web']
 * @property {string} [loginPath='/auth/:provider']              start route (router `:provider` syntax)
 * @property {string} [callbackPath='/auth/:provider/callback']  MUST match the `callback` template given to createOAuth
 * @property {{ name?: string, secret?: string, path?: string, secure?: boolean, sameSite?: 'lax'|'strict'|'none', maxAge?: number }} [cookie]
 * @property {string} [secret]                         key to protect the client-held session (api mode)
 * @property {'sign' | 'jwe'} [seal='sign']            'sign' = HMAC (tamper-evident); 'jwe' = encrypt (also confidential)
 * @property {string[]} [scope]
 * @property {(ctx: object) => unknown} [onSuccess]
 * @property {(ctx: object) => unknown} [onError]
 * @property {string} [attach='oauth']
 */
/**
 * @param {LoginConfig} config
 */
export function normalizeLoginConfig(config: LoginConfig): Readonly<{
    oauth: {
        authorize(name: string, options?: {
            scope?: string[];
            sessionBinding?: string;
            params?: Record<string, string>;
        }): Promise<{
            url: string;
            session: string;
            warnings: import("../providers/_base.js").Warning[];
        }>;
        callback(name: string, query: Record<string, unknown>, options?: {
            session?: string;
            sessionBinding?: string;
        }): Promise<{
            tokens: Record<string, unknown>;
            user: NormalizedUser;
            warnings: Warning[];
        }>;
        refresh(name: string, refreshToken: string): Promise<Record<string, unknown>>;
        revoke(name: string, token: string, tokenTypeHint?: string): Promise<Record<string, unknown>>;
        readonly providers: string[];
        has(name: string): boolean;
    };
    mode: "web" | "api";
    loginPath: string | undefined;
    callbackPath: string | undefined;
    cookieMode: boolean;
    signed: boolean;
    seal: "sign" | "jwe";
    cookieName: string | undefined;
    secret: string | undefined;
    cookieOptions: {
        path: string | undefined;
        sameSite: "lax" | "strict" | "none";
        secure: boolean;
        maxAge: number | undefined;
    };
    scope: string[] | undefined;
    onSuccess: ((ctx: object) => unknown) | undefined;
    onError: ((ctx: object) => unknown) | undefined;
    attach: string | undefined;
}>;
/**
 * Begin a login. Returns the provider `authorizeUrl`, the (optionally
 * signed) `session`, and — web + cookie mode — the cookie to set.
 *
 * @param {ReturnType<typeof normalizeLoginConfig>} config
 * @param {string} provider
 * @param {{ scope?: string[] }} [options]
 * @returns {Promise<{ authorizeUrl: string, session: string, warnings: unknown, setCookie: object | null }>}
 */
export function startLogin(config: ReturnType<typeof normalizeLoginConfig>, provider: string, options?: {
    scope?: string[];
}): Promise<{
    authorizeUrl: string;
    session: string;
    warnings: unknown;
    setCookie: object | null;
}>;
/**
 * Complete a login. The session is recovered per mode: from the cookie
 * (web) or from the caller-supplied client-held value (api / store mode
 * passes neither and lets `createOAuth`'s store look it up by `state`).
 *
 * @param {ReturnType<typeof normalizeLoginConfig>} config
 * @param {string} provider
 * @param {Record<string, unknown>} query    the callback params (`code`, `state`, `iss`, …)
 * @param {{ cookieValue?: string, session?: string }} [carrier]
 * @returns {Promise<{ result: object, clearCookie: string | null }>}
 */
export function completeLogin(config: ReturnType<typeof normalizeLoginConfig>, provider: string, query: Record<string, unknown>, carrier?: {
    cookieValue?: string;
    session?: string;
}): Promise<{
    result: object;
    clearCookie: string | null;
}>;
/**
 * `value.sig` with `sig = base64url(HMAC-SHA256(secret, value))`.
 *
 * @param {string} value @param {string} secret @returns {string}
 */
export function signValue(value: string, secret: string): string;
/**
 * Constant-time verify; returns the payload or `undefined` on any
 * signature mismatch.
 *
 * @param {string | undefined} signed @param {string} secret @returns {string | undefined}
 */
export function unsignValue(signed: string | undefined, secret: string): string | undefined;
/**
 * `seal: 'jwe'` — encrypt the session as a compact JWE (`dir` + A256GCM)
 * so the client sees only ciphertext, not the `state` / `codeVerifier` /
 * `nonce`. The key is derived from the caller's secret.
 *
 * @param {string} value @param {string} secret @returns {Promise<string>}
 */
export function sealValue(value: string, secret: string): Promise<string>;
/**
 * Decrypt a sealed session; `undefined` on any failure (tampered / wrong
 * key / not a JWE).
 *
 * @param {string | undefined} sealed @param {string} secret @returns {Promise<string | undefined>}
 */
export function unsealValue(sealed: string | undefined, secret: string): Promise<string | undefined>;
/**
 * `web`-mode handoff: `onSuccess` if given, else attach to `req[attach]`
 * and continue (Express middleware chaining).
 *
 * @param {ReturnType<typeof normalizeLoginConfig>} config
 * @param {object} req @param {object} res @param {object} result @param {() => unknown} next
 */
export function handoff(config: ReturnType<typeof normalizeLoginConfig>, req: object, res: object, result: object, next: () => unknown): unknown;
export type LoginMode = "web" | "api";
export type LoginConfig = {
    oauth: ReturnType<typeof import("../oauth.js").createOAuth>;
    mode?: LoginMode | undefined;
    /**
     * start route (router `:provider` syntax)
     */
    loginPath?: string | undefined;
    /**
     * MUST match the `callback` template given to createOAuth
     */
    callbackPath?: string | undefined;
    cookie?: {
        name?: string;
        secret?: string;
        path?: string;
        secure?: boolean;
        sameSite?: "lax" | "strict" | "none";
        maxAge?: number;
    } | undefined;
    /**
     * key to protect the client-held session (api mode)
     */
    secret?: string | undefined;
    /**
     * 'sign' = HMAC (tamper-evident); 'jwe' = encrypt (also confidential)
     */
    seal?: "sign" | "jwe" | undefined;
    scope?: string[] | undefined;
    onSuccess?: ((ctx: object) => unknown) | undefined;
    onError?: ((ctx: object) => unknown) | undefined;
    attach?: string | undefined;
};