/** Pure, privacy-safe classification of authentication boundaries observed in DOM metadata. */
export type AuthBoundaryMetadata = {
    /** A generated DOM selector; never a field value or text content. */
    selector?: string;
    inputType?: string | null;
    autocomplete?: string | null;
    formAction?: string | null;
    route?: string | null;
    redirectTo?: string | null;
    redirectStatus?: number | null;
    value?: unknown;
    text?: unknown;
};
export type AuthBoundaryDiagnostic = {
    kind: 'credential-input';
    reason: 'password-input' | 'credential-autocomplete';
    selector?: string;
} | {
    kind: 'auth-form';
    reason: 'auth-form-action';
    selector?: string;
    formAction: string;
} | {
    kind: 'auth-redirect';
    reason: 'auth-route-redirect';
    route?: string;
    redirectTo: string;
    redirectStatus: number;
};
/**
 * True when a redacted pathname contains a strong auth segment (login, oauth, sso, …).
 * Shared by the classifier and crawl redirect retention — keep one definition.
 * Accepts pathname only; callers must redact query/fragment first.
 */
export declare function isAuthPath(pathname: string | undefined | null): boolean;
/** Classify DOM-derived metadata into deterministic diagnostics containing no secrets. */
export declare function classifyAuthBoundary(metadata: AuthBoundaryMetadata[]): AuthBoundaryDiagnostic[];