/**
 * The single "establish a session and return the user where they started"
 * primitive.
 *
 * Before this file the framework had five return-path validators, four
 * "don't redirect to yourself" checks, and two complete copies of the login
 * document — so every anti-loop fix landed on whichever fork the ticket named
 * and the reports never stopped. Every sign-in surface now calls exactly this:
 * the client gate (`RequireSession`), the login document, the sign-in entry
 * route, and every template button.
 *
 * The continuation is a PATH, never a URL, and it is carried opaquely in the
 * `c` query param. That combination is why nesting is structurally impossible
 * rather than guarded against:
 *
 *  - the grammar is not recursive: decoding a continuation yields a string,
 *    never another continuation;
 *  - `signInJourney` returns `signInHref: null` — no token at all — when the
 *    browser is already at an auth entry path, so the one function permitted
 *    to mint continuations refuses to mint the dangerous value;
 *  - the sign-in URL is `<base>/_agent-native/sign-in?c=<opaque>`, so
 *    "capture the current location as the return" has no URL-shaped input to
 *    re-encode;
 *  - `c` does not look like a URL, so Better Auth's `callbackURL`, a proxy, or
 *    a future patch cannot mistake it for a redirect target and wrap it.
 *
 * There is exactly ONE auth-entry-path predicate left in the codebase and it
 * lives in `normalizeAppPath` below. The four call-site copies are gone.
 *
 * Not signed. Signing buys nothing: the user already controls their own
 * browser and can type any URL. The only threat is open redirect, which is a
 * validation problem, not an integrity problem — and an HMAC would add a
 * secret dependency to code that must run inside a CDN-cached public document.
 */
export declare const SIGN_IN_CONTINUATION_PARAM = "c";
/**
 * Legacy entry-point grammar. Generated apps in the wild hand-write
 * `/_agent-native/sign-in?return=<path>` and are not upgradeable, so the
 * CONSUMER side of this param is permanent API surface. New producers must
 * emit `c` instead; deleting the consumer fallback silently redirects every
 * generated app to `/`, which reads as a UX quirk rather than a regression and
 * therefore will not be caught.
 */
export declare const SIGN_IN_LEGACY_RETURN_PARAM = "return";
export declare const SIGN_IN_ENTRY_PATH = "/_agent-native/sign-in";
/** Max length of an encoded continuation token, in characters. */
export declare const SIGN_IN_CONTINUATION_MAX_LENGTH = 512;
export interface SignInJourney {
    /**
     * Where to send the browser to authenticate — always same-origin, always
     * under the app base path, always carrying exactly one continuation.
     * `null` when the browser is ALREADY at an auth entry path: there is no
     * such thing as signing in from the sign-in page, and a caller must not
     * navigate. Distinguishable absence, never a lookalike default.
     */
    readonly signInHref: string | null;
    /**
     * Where to send the browser once a session exists. Always same-origin,
     * always under the app base path, never an auth entry path. Always a value —
     * worst case the app home, which is a correct answer rather than a swallowed
     * failure.
     */
    readonly resumeHref: string;
}
export interface SignInJourneyInput {
    /** Current location as a PATH: pathname + search + hash. Never a URL. */
    at: string;
    /** Whatever arrived in the `c` query param, if anything. */
    continuation?: string | null;
    /**
     * Legacy `?return=` value, if anything. Accepted forever; see
     * SIGN_IN_LEGACY_RETURN_PARAM.
     */
    legacyReturn?: string | null;
    /** App base path, `""` for root deploys. */
    basePath?: string;
}
/**
 * Validate a candidate app path. Returns the normalised full path (base path
 * included) or `null`. Pass `basePath` to additionally require containment —
 * omit it for surfaces such as provider OAuth returns whose targets are not
 * guaranteed to be base-path prefixed.
 */
export declare function normalizeAppPath(raw: string | null | undefined, basePath?: string): string | null;
/** Encode an app path as a continuation token. `""` for anything not returnable. */
export declare function encodeContinuation(path: string | null | undefined, basePath?: string): string;
/** Decode a continuation token to an app path. `null` for anything invalid. */
export declare function decodeContinuation(token: string | null | undefined, basePath?: string): string | null;
export declare function signInJourney(input: SignInJourneyInput): SignInJourney;
/**
 * The runtime as `<script>`-embeddable source declaring
 * `__anCreateSignInJourney(basePath)`.
 *
 * Emitted from the same function the server and client call, so the login
 * document cannot drift from the module — which is exactly how the repo ended
 * up with two login pages disagreeing about return paths in the first place.
 * `packages/core` builds with plain `tsc` (no bundler, no minifier), so the
 * emitted source is verbatim; `createSignInJourneyRuntime` must therefore stay
 * self-contained, ES5-compatible, and free of references to module scope.
 */
export declare function signInJourneyInlineScript(): string;
//# sourceMappingURL=sign-in-journey.d.ts.map