import * as s from '../schemas';
import type { Transport } from './transport';
/**
 * Whether a login-method target is a safe same-origin relative API path. The
 * login screen is the one page where a misconfigured/compromised manifest could
 * redirect CREDENTIALS off-origin, so a `submit_path`/`href` MUST start `/api/`
 * — anything else (absolute URL, protocol-relative `//host`, missing prefix) is
 * rejected. The `/api/` prefix already excludes `//`-prefixed values; the
 * explicit double-slash clause is kept for readability.
 */
export declare function isSafeApiPath(path: string): boolean;
export declare function loginClient(t: Transport): {
    getLoginMethods: (options?: {
        signal?: AbortSignal;
    }) => Promise<{
        methods: ({
            shape: "form";
            id: string;
            title: string;
            purpose: "login" | "invite";
            fields: {
                name: string;
                label: string;
                secret: boolean;
                autocomplete?: string | undefined;
            }[];
            submit_path: string;
        } | {
            shape: "button";
            id: string;
            label: string;
            href: string;
            icon?: string | undefined;
        })[];
        needs_setup: boolean;
        setup_login?: {
            kinds: ("invite" | "password")[];
        } | null | undefined;
    }>;
    submitLoginForm: (path: string, values: Record<string, string>) => Promise<{
        token: string;
        user_id: string;
    }>;
    exchangeSsoCode: (code: string) => Promise<{
        token: string;
        user_id: string;
    }>;
    claimLogin: (body: {
        token: string;
    }) => Promise<{
        token: string;
        user_id: string;
    }>;
    submitSetup: (body: s.SetupBody) => Promise<{
        owner_user_id: string;
        key_user_id: string;
        api_key: string;
        key_fingerprint: string;
        login_attached: boolean;
        invite_token?: string | null | undefined;
        login_path?: string | null | undefined;
    }>;
};
export declare function logoutClient(t: Transport): {
    logout: () => Promise<{
        revoked: boolean;
    }>;
};
//# sourceMappingURL=login-client.d.ts.map