/**
 * Consent Auth Mode Types
 *
 * Canonical type definitions for authentication modes and their configurations.
 *
 * ## Consent Flow Architecture
 *
 * The consent flow has two patterns based on the auth mode:
 *
 * ### Flow 1: Consent Only (CONSENT_ONLY mode) - 2 Screens
 * ```
 * [Consent Screen] → [Success Screen]
 *       ↓
 *   User confirms → DelegationCredential (VC) created
 * ```
 *
 * ### Flow 2: Auth First (CREDENTIALS, OAUTH, etc.) - 3 Screens
 * ```
 * [Auth Screen] → [Consent Screen] → [Success Screen]
 *       ↓               ↓
 *   Verify identity   User confirms → DelegationCredential (VC) created
 * ```
 *
 * ## Relationship to AuthorizationRequirement
 *
 * - `AUTH_MODES` here define what UI to render for authentication
 * - `AuthorizationRequirement` in @kya-os/contracts defines what a TOOL requires
 *
 * Mapping:
 * | AUTH_MODE | AuthorizationRequirement.type |
 * |-----------|-------------------------------|
 * | CONSENT_ONLY | 'none' |
 * | CREDENTIALS | 'password' |
 * | OAUTH | 'oauth' |
 * | IDV | 'idv' |
 * | MAGIC_LINK | (future) |
 * | OTP | (future) |
 *
 * @module @kya-os/consent/types/modes
 */
/**
 * Supported Authentication Modes
 *
 * Constants for all supported auth modes in consent pages.
 * Matches AgentShield's AUTH_MODES constant.
 *
 * The mode determines the screen flow:
 * - CONSENT_ONLY: Consent → Success (2 screens) - Direct to consent, no auth
 * - All others: Auth → Consent → Success (3 screens) - Auth first, then consent
 */
export declare const AUTH_MODES: {
    /** Simple consent with no authentication - Consent → Success (2 screens) */
    readonly CONSENT_ONLY: "consent-only";
    /** Username/password authentication - Auth → Consent → Success (3 screens) */
    readonly CREDENTIALS: "credentials";
    /** OAuth provider authentication - Auth → Consent → Success (3 screens) */
    readonly OAUTH: "oauth";
    /** Email magic link authentication - Auth → Consent → Success (3 screens) */
    readonly MAGIC_LINK: "magic-link";
    /** One-time password (SMS/TOTP) authentication - Auth → Consent → Success (3 screens) */
    readonly OTP: "otp";
    /** QR code scanning authentication (future) - Auth → Consent → Success (3 screens) */
    readonly QR_CODE: "qr-code";
    /** Passkey/WebAuthn authentication (future) - Auth → Consent → Success (3 screens) */
    readonly PASSKEY: "passkey";
    /** Identity verification (future) - Auth → Consent → Success (3 screens) */
    readonly IDV: "idv";
};
/**
 * Auth Mode Type
 *
 * Union of all supported authentication mode values.
 */
export type AuthMode = (typeof AUTH_MODES)[keyof typeof AUTH_MODES];
/**
 * Credentials Mode Configuration
 *
 * Configuration for username/password authentication mode.
 */
export interface CredentialsConfig {
    /** Username field label */
    usernameLabel?: string;
    /** Username field placeholder */
    usernamePlaceholder?: string;
    /** Password field label */
    passwordLabel?: string;
    /** Password field placeholder */
    passwordPlaceholder?: string;
    /** Whether to show "Remember me" checkbox */
    showRememberMe?: boolean;
    /** Whether to show "Forgot password" link */
    showForgotPassword?: boolean;
    /** URL for forgot password page */
    forgotPasswordUrl?: string;
}
/**
 * OAuth Mode Configuration
 *
 * Configuration for OAuth provider authentication mode.
 */
export interface OAuthConfig {
    /** OAuth provider identifier */
    providerId?: string;
    /** Display name for the OAuth provider */
    providerName?: string;
    /** OAuth button text */
    buttonText?: string;
}
/**
 * Magic Link Mode Configuration
 *
 * Configuration for email magic link authentication mode.
 */
export interface MagicLinkConfig {
    /** Whether magic link is enabled */
    enabled?: boolean;
    /** Email field label */
    emailLabel?: string;
    /** Email field placeholder */
    emailPlaceholder?: string;
    /** Send magic link button text */
    buttonText?: string;
    /** Cooldown period before allowing resend (seconds) */
    resendCooldown?: number;
}
/**
 * OTP Mode Configuration
 *
 * Configuration for one-time password authentication mode.
 */
export interface OTPConfig {
    /** Whether OTP is enabled */
    enabled?: boolean;
    /** Phone/contact field label */
    phoneLabel?: string;
    /** Phone/contact field placeholder */
    phonePlaceholder?: string;
    /** Instructions text */
    instructions?: string;
    /** Number of OTP digits */
    digits?: number;
    /** Cooldown period before allowing resend (seconds) */
    resendCooldown?: number;
}
/**
 * QR Code Mode Configuration
 *
 * Configuration for QR code scanning authentication mode.
 */
export interface QRCodeConfig {
    /** Whether QR code auth is enabled */
    enabled?: boolean;
    /** Instructions text */
    instructions?: string;
    /** QR code size in pixels */
    size?: number;
    /** Whether to show manual entry option */
    showManualEntry?: boolean;
}
/**
 * Passkey Mode Configuration
 *
 * Configuration for passkey/WebAuthn authentication mode.
 */
export interface PasskeyConfig {
    /** Whether passkey auth is enabled */
    enabled?: boolean;
    /** Instructions text */
    instructions?: string;
    /** Button text */
    buttonText?: string;
    /** Whether to show browser compatibility info */
    showCompatibilityInfo?: boolean;
}
/**
 * IDV (Identity Verification) Mode Configuration
 *
 * Configuration for identity verification authentication mode.
 */
export interface IDVConfig {
    /** Whether IDV is enabled */
    enabled?: boolean;
    /** IDV provider name */
    providerName?: string;
    /** Type of verification (e.g., 'document', 'selfie', 'both') */
    verificationType?: "document" | "selfie" | "both";
    /** Instructions text */
    instructions?: string;
    /** Estimated time for verification */
    estimatedTime?: string;
}
/**
 * Combined Mode Configurations
 *
 * Container for all mode-specific configurations.
 */
export interface ModeConfigs {
    /** Credentials mode config */
    credentials?: CredentialsConfig;
    /** OAuth mode config */
    oauth?: OAuthConfig;
    /** Magic link mode config */
    magicLink?: MagicLinkConfig;
    /** OTP mode config */
    otp?: OTPConfig;
    /** QR code mode config */
    qrCode?: QRCodeConfig;
    /** Passkey mode config */
    passkey?: PasskeyConfig;
    /** IDV mode config */
    idv?: IDVConfig;
}
/**
 * Auth Mode Registry Entry
 *
 * Metadata for a registered authentication mode.
 */
export interface AuthModeRegistryEntry {
    /** Mode identifier */
    id: AuthMode;
    /** Display name */
    displayName: string;
    /** Brief description */
    description: string;
    /** Lucide icon name */
    iconName: string;
    /** Whether this mode has a success view */
    hasSuccessView: boolean;
    /** Whether this mode is implemented */
    implemented: boolean;
    /** Tags for filtering/categorization */
    tags: string[];
}
/**
 * Consent Provider Types for delegation metadata
 *
 * These are the values stored in delegation metadata.provider_type
 * and must match AgentShield's tool protection authorization.type values.
 *
 * IMPORTANT: This must stay in sync with @kya-os/contracts/tool-protection CONSENT_PROVIDER_TYPES
 */
export declare const PROVIDER_TYPES: {
    /** Consent-only - no authentication, just clickwrap agreement */
    readonly NONE: "none";
    /** Password-based authentication (email/password, username/password) */
    readonly PASSWORD: "password";
    /** OAuth2 provider authentication */
    readonly OAUTH2: "oauth2";
    /** Email magic link authentication */
    readonly MAGIC_LINK: "magic_link";
    /** One-time password (SMS/email code) */
    readonly OTP: "otp";
};
export type ProviderType = (typeof PROVIDER_TYPES)[keyof typeof PROVIDER_TYPES];
/**
 * AUTH_MODE to PROVIDER_TYPE Mapping
 *
 * This is the CANONICAL mapping documented in the module header.
 * It maps UI-level auth modes to API-level provider types.
 *
 * IMPORTANT: This mapping ensures type-safety between:
 * - AUTH_MODES (what UI/flow to render)
 * - PROVIDER_TYPES (what to send to AgentShield for authorization validation)
 *
 * The tool protection layer expects authorization.type to match these values.
 */
export declare const AUTH_MODE_TO_PROVIDER_TYPE: Record<AuthMode, ProviderType>;
/**
 * Get the provider_type for a given auth mode
 *
 * This is the type-safe way to convert between UI auth modes
 * and API provider types. Use this instead of hardcoding strings.
 *
 * @param mode - The auth mode (from AUTH_MODES)
 * @returns The corresponding provider type for delegation metadata
 *
 * @example
 * ```ts
 * import { AUTH_MODES, getProviderTypeForAuthMode } from '@kya-os/consent';
 *
 * const mode = AUTH_MODES.CREDENTIALS;
 * const providerType = getProviderTypeForAuthMode(mode);
 * // providerType === 'password' (NOT 'credential'!)
 * ```
 */
export declare function getProviderTypeForAuthMode(mode: AuthMode): ProviderType;
//# sourceMappingURL=modes.types.d.ts.map