import { type Operation } from "effection";
import type { Habery } from "./habbing.js";
import { type RuntimeServices } from "./runtime-services.js";
interface AuthenticatorOptions {
    services?: RuntimeServices;
}
/**
 * Well-known OOBI authenticator for one `Habery`.
 *
 * KERIpy correspondence:
 * - mirrors the `Authenticator` flow that advances `woobi.` -> `mfa.` ->
 *   `rmfa.` and writes `wkas.`
 *
 * Ownership model:
 * - `woobi.` holds queued well-known auth work
 * - `mfa.` holds one pending HTTP authorization request
 * - `rmfa.` holds terminal well-known auth results
 * - `wkas.` records successful `(cid, url)` authorizations
 */
export declare class Authenticator {
    readonly hby: Habery;
    readonly services: RuntimeServices;
    constructor(hby: Habery, options?: AuthenticatorOptions);
    /** Process one bounded auth step if queued well-known work exists. */
    processOnce(): Operation<void>;
    /** Continuous auth doer for long-lived runtime hosts. */
    authDo(): Operation<never>;
    /** Promote one eligible `woobi.` record into the fetchable `mfa.` queue. */
    private promoteQueuedWellKnown;
    /** Return the next pending `mfa.` auth record, if any. */
    private nextPendingAuth;
    /** Fetch one `mfa.` record and persist the terminal auth result. */
    private processPendingAuth;
}
export {};
//# sourceMappingURL=authenticating.d.ts.map