export interface Membership {
    /** Org display name (e.g. "Acme", or "Personal (alice)" for the personal org). */
    orgName: string;
    /** "personal" | "team" — the personal org is the default active org. */
    orgKind: "personal" | "team";
    role?: string;
}
export interface Identity {
    email: string;
    /** All orgs the signed-in user belongs to (switcher source). */
    memberships: Membership[];
}
/**
 * The auth-flow backend seam. `exchange` redeems the PKCE code for a raw PAT; `me` confirms
 * identity + orgs with that PAT. Both are injected so a stub backend drives the CLI tests.
 */
export interface AuthBackend {
    /** POST /access-tokens/exchange {code, code_verifier} → the raw PAT ("vct_…"). */
    exchange(code: string, codeVerifier: string): Promise<string>;
    /** GET /me with Bearer <pat> → identity + orgs. */
    me(pat: string): Promise<Identity>;
}
/** The real HTTP-backed AuthBackend, pointed at a Vincentt API base URL. */
export declare function httpAuthBackend(apiBase: string): AuthBackend;
/**
 * Map the /me response shape onto our Identity. The backend returns memberships with an org
 * name + kind; we keep the projection resilient to the exact field names the Go handler emits
 * (name/orgName, kind/orgKind) so a minor contract wording change doesn't break login.
 */
export declare function normalizeMe(raw: unknown): Identity;