/**
 * account-service client for staff single sign-on (KDI-5225).
 *
 * The business owner connects their organisation's identity provider (Lark first)
 * here; account-service checks the permission and the IdP credentials. Errors keep
 * the server's `code`, so the page can explain each refusal instead of showing the
 * raw message.
 */
export type StaffSsoScopePurpose = "user_id" | "mobile" | "email" | "org" | "directory" | "message";
export interface StaffSsoTypeSetup {
    type: string;
    label: string;
    iconUrl: string;
    consoleUrl: string;
    redirectUri: string;
    scopes: {
        scope: string;
        required: boolean;
        purpose: StaffSsoScopePurpose;
    }[];
}
export interface StaffSsoLarkIdpView {
    type: "lark";
    region: "larksuite";
    appId: string;
    /** Always "set": secrets never leave account-service. */
    appSecret: string;
    scopes: string[];
    events?: {
        verificationToken: string;
        encryptKey: string;
    };
}
export type StaffSsoIdpView = StaffSsoLarkIdpView;
export interface StaffSsoProviderView {
    /** The provider slug. */
    _id: string;
    businessId: string;
    displayName: string;
    label?: string;
    enabled: boolean;
    orgKey: string;
    inviteMatch: "mobile" | "email" | "none";
    /** Work email domains; the login page finds the company from a staff member's email. */
    emailDomains?: string[];
    idp: StaffSsoIdpView;
    /** Staff accounts linked to this provider; it can be removed only at 0. */
    staffAccounts: number;
    /** The IdP app's own name and picture, when the IdP shares them (Lark: Bot turned on). */
    app?: {
        name: string;
        avatarUrl: string;
    };
    createdAt: string;
    updatedAt: string;
    updatedBy?: string;
}
export interface StaffSsoSettings {
    providers: StaffSsoProviderView[];
    /** False when the business may not connect another provider. */
    canAdd: boolean;
    /** False while single sign-on is live for another business. */
    canEnable: boolean;
    types: StaffSsoTypeSetup[];
}
export interface StaffSsoProviderCreate {
    /** The company ID staff type at sign-in; fixed once created. */
    slug: string;
    displayName: string;
    emailDomains?: string[];
    idp: {
        type: "lark";
        appId: string;
        appSecret: string;
    };
}
export interface StaffSsoProviderPatch {
    enabled?: boolean;
    displayName?: string;
    emailDomains?: string[];
    idp?: {
        appSecret: string;
    };
}
declare const SERVER_CODES: readonly ["invalid_body", "invalid_credentials", "provider_exists", "org_taken", "app_taken", "not_found", "live_elsewhere", "org_mismatch", "in_use", "domain_taken", "slug_taken", "provider_unavailable"];
export type StaffSsoErrorCode = (typeof SERVER_CODES)[number] | "unauthorized" | "forbidden" | "network" | "unknown";
export declare class StaffSsoApiError extends Error {
    readonly code: StaffSsoErrorCode;
    readonly status: number | undefined;
    constructor(code: StaffSsoErrorCode, status: number | undefined, message: string);
}
/** Maps an axios failure to the server's code; status alone covers 401 and 403. */
export declare function toStaffSsoError(error: unknown): StaffSsoApiError;
export declare const staffSsoApi: {
    read(businessId: string): Promise<StaffSsoSettings>;
    create(businessId: string, body: StaffSsoProviderCreate): Promise<StaffSsoSettings>;
    update(businessId: string, slug: string, body: StaffSsoProviderPatch): Promise<StaffSsoSettings>;
    remove(businessId: string, slug: string): Promise<StaffSsoSettings>;
};
export {};