import type { TokenStore } from './token-storage.js';
export interface OrgMembership {
    name: string;
    role: string;
    slug: string;
    workosOrgId: string;
}
export interface OrchestrateLoginInput {
    apiUrl: string;
    initialAccessToken: string;
    initialRefreshToken: string;
    user: {
        email?: string;
        id: string;
    };
}
export interface OrchestrateLoginResult {
    defaultOrg: OrgMembership;
    defaultOrgId: string;
    email?: string;
    mintedOrgSlugs: string[];
    organizations: OrgMembership[];
    skippedOrgSlugs: string[];
    tokenStore: TokenStore;
    userId: string;
}
/**
 * Multi-org token minting orchestration (qfg-mol-k27, plan item 7).
 *
 * Given the device-auth result, this:
 *   1. Calls /api/v1/me/organizations to enumerate all orgs the user belongs to.
 *   2. For each org (capped at 10 alphabetically — see plan rate-limit guard),
 *      calls WorkOS /user_management/authenticate with grant_type=refresh_token
 *      + organization_id in parallel to mint an org-scoped TokenSet.
 *   3. Builds the per-org TokenStore with a defaultOrgId set to the only org
 *      (single-org user) or the first slug alphabetically (multi-org).
 *
 * Returns the in-memory TokenStore plus enough metadata for login.ts to print
 * the user-facing summary; persistence is the caller's responsibility so we
 * keep this helper free of filesystem side effects (testable in isolation).
 */
export declare const orchestrateMultiOrgLogin: (input: OrchestrateLoginInput) => Promise<OrchestrateLoginResult>;