import { type BetterAuthOptions } from "better-auth";
import type { H3Event } from "h3";
import { type SignupOrigin } from "./attribution.js";
import { type EmailReadiness } from "./email.js";
export declare function resumeIdentityRekeysForEmail(email: string): Promise<void>;
export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, type AuthLoginMode, } from "./auth-login-mode.js";
export declare function hasBetterAuthUserEmail(email: string): Promise<boolean>;
/**
 * The Better Auth user id for a verified email, or `undefined` when no
 * account has that email. A failed lookup throws: a caller that treated it as
 * "no account" would tell a signed-in user to sign in.
 */
export declare function findBetterAuthUserIdForEmail(email: string): Promise<string | undefined>;
export declare function getBetterAuthUserIdForEmail(email: string): Promise<string | undefined>;
export interface BetterAuthUserCreateContext {
    headers?: Headers | null;
    request?: {
        headers?: Headers | null;
        url?: string;
    } | null;
    /** Better Auth's endpoint context; `session` is the acting user, if any. */
    context?: {
        session?: {
            user?: {
                id?: string;
            } | null;
        } | null;
    } | null;
}
export declare function emitSignupEventForCreatedUser(user: {
    id?: string;
    email?: string;
    name?: string | null;
}, context?: BetterAuthUserCreateContext | null): Promise<void>;
export declare function hasGoogleAuthIdentity(email: string): Promise<boolean | undefined>;
export declare function trackSignupEvent({ authProvider, origin, signupMethod, authUserId, email, name, attribution, anonymousId, sessionId, }: {
    authProvider: string;
    origin: SignupOrigin;
    signupMethod?: "google" | "magic_link" | "password";
    authUserId?: string;
    email: string;
    name?: string | null;
    /**
     * First-touch referral attribution derived from the visitor's `an_ft`
     * cookie (see `server/attribution.ts`). Snake_case keys such as
     * `referral_source`, `referrer_user`, and the UTM passthrough are merged
     * into the `signup` event so we can measure where new users came from.
     * `undefined` values are dropped; a missing object is a clean no-op — and
     * it must stay a no-op rather than defaulting to `direct`, so a signup we
     * could not attribute stays visibly different from an unattributed visit.
     */
    attribution?: Record<string, string | undefined>;
    anonymousId?: string;
    sessionId?: string;
}): Promise<void>;
export declare const DEV_AUTH_SECRET_PATH: string;
/**
 * A persisted dev auth secret exists but cannot be used, or cannot be
 * persisted. Deliberately not caught anywhere: a local dev runtime that
 * cannot keep a stable session-signing secret fails the boot loudly instead
 * of silently rotating sessions on every restart.
 */
export declare class DevAuthSecretFileError extends Error {
    readonly reason: "unreadable" | "empty" | "unsafe" | "create-failed" | "race-unreadable";
    constructor(message: string, reason: "unreadable" | "empty" | "unsafe" | "create-failed" | "race-unreadable", options?: {
        cause?: unknown;
    });
}
/**
 * Read the persisted local dev secret from
 * `<appRoot>/.agent-native/dev-auth-secret` (gitignored), creating it
 * exclusively on first use. Existing files are reused verbatim and never
 * overwritten, and the secret value is never logged.
 *
 * Throws `DevAuthSecretFileError` — never degrades — when the file exists
 * but is unreadable or empty, when it cannot be created, or when the file a
 * concurrent creator left behind cannot be read back. Absence is the only
 * non-throwing "create it" outcome.
 */
export declare function resolvePersistedDevAuthSecret(appRoot: string, generateSecret: () => string): string;
/** @internal */
export declare function resolveSignupTrackingIdentity(): {
    app?: string;
    template?: string;
};
/** @internal */
export declare function resolveSignupTrackingProperties(): Record<string, string>;
export declare function shouldSkipEmailVerification(): boolean;
export declare function isDeployPreview(): boolean;
export declare function resolveEmailPasswordAuthPolicy(emailReadiness: EmailReadiness): {
    requireEmailVerification: boolean;
    disableSignUp: boolean;
};
export declare function getAuthSecret(): string;
export interface BetterAuthInstance {
    handler: (request: Request) => Promise<Response>;
    api: {
        getSession: (opts: {
            headers: Headers;
        }) => Promise<{
            user: {
                id: string;
                email: string;
                name: string;
                emailVerified: boolean;
            };
            session: {
                id: string;
                token: string;
                expiresAt: Date;
            };
        } | null>;
        signInEmail: (opts: {
            body: {
                email: string;
                password: string;
            };
            headers?: Headers;
            returnHeaders?: boolean;
        }) => Promise<any>;
        signInMagicLink: (opts: {
            body: {
                email: string;
                name?: string;
                callbackURL?: string;
                newUserCallbackURL?: string;
                errorCallbackURL?: string;
                metadata?: Record<string, unknown>;
            };
            headers: Headers;
        }) => Promise<{
            status: boolean;
        }>;
        listUserAccounts: (opts: {
            headers: Headers;
        }) => Promise<Array<{
            providerId: string;
        }>>;
        setPassword: (opts: {
            body: {
                newPassword: string;
            };
            headers: Headers;
        }) => Promise<{
            status: boolean;
        }>;
        changePassword: (opts: {
            body: {
                currentPassword: string;
                newPassword: string;
            };
            headers: Headers;
        }) => Promise<{
            status: boolean;
        }>;
        signUpEmail: (opts: {
            body: {
                email: string;
                password: string;
                name: string;
                callbackURL?: string;
            };
            headers?: Headers;
        }) => Promise<any>;
        signOut: (opts: {
            headers: Headers;
            returnHeaders?: boolean;
        }) => Promise<any>;
        enableTwoFactor: (opts: {
            body: {
                method: "totp";
                password?: string;
            };
            headers: Headers;
            returnHeaders?: boolean;
        }) => Promise<any>;
        disableTwoFactor: (opts: {
            body: {
                password?: string;
            };
            headers: Headers;
            returnHeaders?: boolean;
        }) => Promise<any>;
        verifyTOTP: (opts: {
            body: {
                code: string;
                trustDevice?: boolean;
            };
            headers: Headers;
            returnHeaders?: boolean;
        }) => Promise<any>;
    };
}
export interface BetterAuthConfig {
    basePath?: string;
    sessionMaxAge?: number;
    socialProviders?: BetterAuthOptions["socialProviders"];
    plugins?: BetterAuthOptions["plugins"];
    googleScopes?: string[];
}
export declare function getBetterAuth(config?: BetterAuthConfig): Promise<BetterAuthInstance>;
export declare function getBetterAuthSync(): BetterAuthInstance | undefined;
export declare function desktopMagicLinkLandingUrl(value: string): string | undefined;
export interface BetterAuthInternalAdapter {
    findUserByEmail: (email: string, options?: {
        includeAccounts: boolean;
    }) => Promise<{
        user: {
            id: string;
            email: string;
            name?: string;
            image?: string | null;
            emailVerified?: boolean;
            onboardingRole?: string | null;
        };
        accounts: Array<{
            id: string;
            providerId: string;
            accountId: string;
        }>;
    } | null>;
    listUsers?: (limit?: number, offset?: number, sortBy?: {
        field: string;
        direction: "asc" | "desc";
    }, where?: Array<{
        field: string;
        value: string | number | boolean | string[] | number[] | Date | null;
        operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with";
        connector?: "AND" | "OR";
        mode?: "sensitive" | "insensitive";
    }>) => Promise<Array<{
        id: string;
        email: string;
        name?: string;
        image?: string | null;
    }>>;
    linkAccount: (account: {
        userId: string;
        providerId: string;
        accountId: string;
    }) => Promise<unknown>;
    createUser: (user: {
        email: string;
        name: string;
        image?: string | null;
        emailVerified?: boolean;
    }) => Promise<{
        id: string;
    }>;
    createSession: (userId: string, dontRememberMe?: boolean, override?: {
        expiresAt?: Date;
    }, overrideAll?: boolean) => Promise<{
        token: string;
    }>;
    deleteSession: (token: string) => Promise<void>;
    createOAuthUser?: (user: {
        email: string;
        name: string;
        image?: string | null;
        emailVerified?: boolean;
    }, account: {
        providerId: string;
        accountId: string;
    }) => Promise<{
        user: {
            id: string;
        };
        account: unknown;
    }>;
    findAccountByProviderId: (accountId: string, providerId: string) => Promise<{
        id: string;
        userId: string;
    } | null>;
    replaceUnverifiedCredentialWithGoogle: (input: {
        userId: string;
        email: string;
        accountId: string;
    }) => Promise<void>;
    updateUser?: (userId: string, data: {
        name?: string;
        image?: string | null;
        emailVerified?: boolean;
        onboardingRole?: string | null;
    }) => Promise<unknown>;
}
type BetterAuthContextAdapter = Omit<BetterAuthInternalAdapter, "replaceUnverifiedCredentialWithGoogle" | "findAccountByProviderId"> & {
    findAccountByProviderId?: BetterAuthInternalAdapter["findAccountByProviderId"];
    findAccountByKey?: (accountKey: {
        accountId: string;
        providerId: string;
    }) => Promise<{
        id: string;
        userId: string;
    } | null>;
};
export declare function normalizeBetterAuthInternalAdapter(adapter: BetterAuthContextAdapter): BetterAuthInternalAdapter | undefined;
/**
 * Replace the only unverified credential account and add Google in one
 * database transaction. The read in ensureGoogleAuthIdentityWithAdapter is
 * only a fast path check; this method revalidates the account set while the
 * transaction owns the user row so a stale lookup cannot delete a different
 * identity.
 */
export declare function replaceUnverifiedCredentialWithGoogle(input: {
    userId: string;
    email: string;
    accountId: string;
}): Promise<void>;
export declare function getBetterAuthInternalAdapter(config?: BetterAuthConfig): Promise<BetterAuthInternalAdapter | undefined>;
type BetterAuthActionSessionOverrides = {
    auth?: BetterAuthInstance;
    createSession?: typeof createBetterAuthSessionForEmail;
    adapter?: BetterAuthInternalAdapter;
};
export declare function withBetterAuthActionSession<T>(email: string, requestHeaders: Headers, action: (headers: Headers) => Promise<T>, overrides?: BetterAuthActionSessionOverrides): Promise<T>;
export declare function createBetterAuthSessionForEmail(email: string, config?: BetterAuthConfig, options?: {
    expiresAt?: Date;
}): Promise<{
    email: string;
    token: string;
    userId: string;
} | null>;
export declare function setBetterAuthSessionCookie(event: H3Event, token: string): Promise<void>;
export interface GoogleAuthIdentity {
    email: string;
    accountId: string;
    name?: string;
    image?: string;
}
export declare function ensureGoogleAuthIdentity(identity: GoogleAuthIdentity): Promise<boolean>;
export declare function ensureGoogleAuthIdentityWithAdapter(adapter: BetterAuthInternalAdapter, identity: GoogleAuthIdentity): Promise<boolean>;
export declare function resetBetterAuth(): Promise<void>;
export declare function buildDatabaseConfig(): Promise<BetterAuthOptions["database"]>;