import type { AuthControllerExtended, MfaFactorSummary } from "@rebasepro/cms-types";
/**
 * A sign-in that is waiting for its second factor.
 *
 * The server refuses the first factor of an account with MFA enrolled with
 * `401 MFA_REQUIRED`, and puts in `details` what the second step needs: a
 * pending token, good for five minutes and for the two challenge routes only,
 * and the factors the account can answer with.
 */
export interface PendingMfaSignIn {
    mfaToken: string;
    factors: MfaFactorSummary[];
}
/**
 * The pending sign-in an `MFA_REQUIRED` refusal describes, or `null` for any
 * other error — including an `MFA_REQUIRED` without the token or a factor to
 * answer with, which no code step could finish.
 */
export declare function readMfaRequired(error: unknown): PendingMfaSignIn | null;
/** Whether this controller can take a sign-in through its second step. */
export declare function canAnswerMfa(authController: AuthControllerExtended): boolean;
/**
 * What a refused challenge means for the code step.
 *
 * - `invalid-code`: the code was wrong; the same challenge takes another.
 * - `exhausted`: the challenge has had its five attempts; the next code needs
 *   a new one.
 * - `expired`: the sign-in itself is over. The pending token lasts five
 *   minutes from the password, and once it has lapsed both routes refuse the
 *   caller as unauthenticated; a challenge that lapsed, or a sign-in revoked
 *   meanwhile, ends the same way. Only a new sign-in gets a new token.
 */
export declare function classifyMfaRefusal(error: unknown): "invalid-code" | "exhausted" | "expired" | "other";