import type { Auth } from '@microsoft/rayfin-auth';
import type { FabricAuthOptions } from './types.js';
/**
 * Embedded-mode Fabric login — acquires a session via postMessage to the
 * parent Fabric Extension Host without opening a popup.
 *
 * 1. Discards any prior session when the host stamps no `?_fu=` hint (see below).
 * 2. Generates PKCE parameters in local variables (no `localStorage`).
 * 3. Sends `auth.requestHandoff` to the parent via `requestHandoff`.
 * 4. Receives the handoff code from the host's `AuthPlugin`.
 * 5. Exchanges the handoff code for tokens via `exchangeVerificationCode`.
 * 6. Creates a session via `createSessionFromTokenResponse`.
 *
 * The session is stored in the iframe's own `localStorage`.
 *
 * **Sign-out is conditional.** This function used to sign out unconditionally, as the only defence
 * against reusing a previous Fabric user's session — at the cost of destroying a valid session (and
 * the serve cookie sealed to it) on every single embedded load. A host that stamps `?_fu=` gives the
 * workload gate an identity to compare, so that defence is redundant and the sign-out is skipped. A
 * host that does not is indistinguishable from the pre-feature world, so the original behaviour is
 * kept for it rather than silently dropping the protection during version skew.
 *
 * @param auth - Auth instance for token exchange and session management.
 * @param options - Fabric auth options (`returnOrigin` required).
 * @throws `AuthError` - On missing options, transport failure, or token exchange error.
 */
export declare function embeddedFabricLogin(auth: Auth, options: FabricAuthOptions): Promise<void>;
//# sourceMappingURL=embeddedFabricLogin.d.ts.map