import type { H3Event } from "h3";
export declare const BUILDER_CALLBACK_PATH = "/_agent-native/builder/callback";
export declare const BUILDER_RELAY_PATH = "/_agent-native/builder/relay";
export declare const BUILDER_RELAY_STATE_PARAM = "_an_relay";
export declare const BUILDER_RELAY_SECRET_ENV = "AGENT_NATIVE_BUILDER_RELAY_SECRET";
export declare const BUILDER_RELAY_TARGET_ORIGINS_ENV = "AGENT_NATIVE_BUILDER_RELAY_TARGET_ORIGINS";
export declare const BUILDER_RELAY_TARGET_DOMAIN_SUFFIXES_ENV = "AGENT_NATIVE_BUILDER_RELAY_TARGET_DOMAIN_SUFFIXES";
export declare const BUILDER_RELAY_TIMESTAMP_HEADER = "x-agent-native-relay-timestamp";
export declare const BUILDER_RELAY_FLOW_HEADER = "x-agent-native-relay-flow";
export declare const BUILDER_RELAY_SIGNATURE_HEADER = "x-agent-native-relay-signature";
export declare const BUILDER_ACCOUNT_PROVISIONING_SECRET_ENV = "AGENT_NATIVE_BUILDER_SSO_SECRET";
declare const BUILDER_RELAY_PURPOSE = "builder-preview-callback-relay";
export interface BuilderPreviewRelayState {
    v: 1;
    purpose: typeof BUILDER_RELAY_PURPOSE;
    flowId: string;
    ownerEmail: string;
    targetOrigin: string;
    basePath: string;
    iat: number;
    exp: number;
}
export interface BuilderRelayCredentials {
    privateKey: string;
    publicKey: string;
    userId: string | null;
    orgName: string | null;
    orgKind: string | null;
    subscription: string | null;
    subscriptionLevel: string | null;
    subscriptionName: string | null;
    isEnterprise: boolean | null;
    isFreeAccount: boolean | null;
}
export interface BuilderRelayRequestBody {
    relayState: string;
    credentials: BuilderRelayCredentials;
}
export declare class BuilderAccountProvisioningError extends Error {
    readonly code: string | null;
    readonly upstreamStatus: number | null;
    readonly upstreamErrorBody: string | null;
    readonly upstreamBodyReadErrorType: string | null;
    constructor(message: string, code?: string, upstreamStatus?: number | null, upstreamErrorBody?: string | null, upstreamBodyReadErrorType?: string | null);
}
export declare function isBuilderAccountAlreadyExistsError(error: unknown): boolean;
export declare function createBuilderConnectState(): string;
export declare function isSignedBuilderConnectState(value: string | null | undefined): boolean;
export declare function isBuilderConnectCallbackUrlAllowed(candidate: string, event: H3Event, callbackOriginOverride?: string): boolean;
export declare function resolveBuilderConnectCallbackUrl(event: H3Event, state?: string, callbackOriginOverride?: string): string | null;
export declare function isSafeBuilderRelayTargetOrigin(value: string): boolean;
export declare function isTrustedBuilderRelayTargetOrigin(value: string): boolean;
export declare function resolveBuilderPreviewRelayTargetOrigin(previewOrigin: string): string;
export declare function signBuilderPreviewRelayState(input: {
    ownerEmail: string;
    targetOrigin: string;
    basePath?: string;
    flowId?: string;
    now?: number;
}): {
    state: string;
    payload: BuilderPreviewRelayState;
};
export declare function verifyBuilderPreviewRelayState(state: string | null | undefined, options?: {
    now?: number;
}): BuilderPreviewRelayState | null;
export declare function verifyBuilderPreviewRelayStateForCallback(state: string | null | undefined, options?: {
    now?: number;
}): BuilderPreviewRelayState | null;
export declare function getBuilderPreviewRelayUrl(payload: BuilderPreviewRelayState): string;
export declare function createBuilderRelayRequest(relayState: string, credentials: BuilderRelayCredentials, options?: {
    now?: number;
}): {
    body: string;
    headers: Record<string, string>;
    url: string;
};
export declare function verifyBuilderRelayRequest(input: {
    body: string;
    timestamp: string | null | undefined;
    flowId: string | null | undefined;
    signature: string | null | undefined;
    requestOrigin: string;
    requestBasePath: string;
    now?: number;
}): {
    payload: BuilderPreviewRelayState;
    body: BuilderRelayRequestBody;
} | null;
export declare const BUILDER_STATE_PARAM = "_an_state";
export declare const BUILDER_CONNECT_PARAM = "_an_connect";
export declare const BUILDER_CONNECT_STATE_COOKIE = "an_builder_connect_state";
export declare const BUILDER_CONNECT_OWNER_COOKIE = "an_builder_connect_owner";
export declare const BUILDER_SIGNUP_SOURCE_PARAM = "signupSource";
export declare const BUILDER_AGENT_NATIVE_FLOW_PARAM = "agentNativeFlow";
export declare const BUILDER_AGENT_NATIVE_CONNECT_SOURCE_PARAM = "agentNativeConnectSource";
export declare const BUILDER_AGENT_NATIVE_APP_PARAM = "agentNativeApp";
export declare const BUILDER_AGENT_NATIVE_TEMPLATE_PARAM = "agentNativeTemplate";
export declare const BUILDER_CONNECT_MODE_PARAM = "_an_mode";
export declare const BUILDER_PREVIEW_ORIGIN_HEADER = "x-agent-native-preview-origin";
export declare const BUILDER_AGENT_NATIVE_PROVISION_MODE = "agent-native";
export declare const BUILDER_PROVISIONING_TOKEN_PARAM = "_an_provision";
export declare const BUILDER_CONNECT_ATTEMPT_PARAM = "_an_connect_attempt";
export declare function parseBuilderConnectStateCookie(value: string | null | undefined): string[] | null;
export declare function appendBuilderConnectStateCookie(value: string | null | undefined, state: string): string;
export declare function removeBuilderConnectStateCookie(value: string | null | undefined, state: string): string;
export interface BuilderConnectCallbackStateResolution {
    state: string | null;
    /**
     * Set when the cookie itself is why this attempt cannot resolve a state.
     * Nothing else prunes it on failure, so an unusable cookie would make every
     * later retry unresolvable too — and the restart the error message asks for
     * is what appends the next state and keeps the trap armed.
     */
    resetStateCookie: boolean;
}
export declare function resolveBuilderConnectCallbackState(queryState: string | null, cookieState: string | null | undefined): BuilderConnectCallbackStateResolution;
export interface BuilderConnectTrackingParams {
    signupSource?: string;
    agentNativeFlow?: string;
    agentNativeConnectSource?: string;
    agentNativeApp?: string;
    agentNativeTemplate?: string;
}
export declare function getBuilderConnectTrackingParams(params: URLSearchParams): BuilderConnectTrackingParams;
export declare function builderConnectTrackingProperties(tracking: BuilderConnectTrackingParams): Record<string, string>;
export declare function withBuilderConnectTrackingParams(url: string, tracking: BuilderConnectTrackingParams): string;
export interface BuilderBrowserStatus {
    configured: boolean;
    builderEnabled: boolean;
    branchProjectIdConfigured: boolean;
    agentNativeProvisioningEnabled: boolean;
    agentNativeProvisioningToken?: string;
    branchProjectId?: string;
    envManaged: boolean;
    credentialSource?: "user" | "org" | "workspace" | "env";
    canDisconnect?: boolean;
    builderReauthorizationRequired?: boolean;
    authError?: {
        message: string;
        at: number;
    };
    connectError?: {
        message: string;
        at: number;
        code?: string;
    };
    appHost: string;
    apiHost: string;
    cliAuthUrl?: string;
    connectUrl: string;
    publicKeyConfigured: boolean;
    privateKeyConfigured: boolean;
    userId?: string;
    orgName?: string;
    /**
     * The Builder space(s) the effective credential can reach, with their real
     * display names (derived from the Admin GraphQL API). A `bpk-` key is
     * space-scoped, so today this is one entry; the list shape lets the Sources
     * drill-down grow to multiple spaces without a restructure. Absent/empty when
     * the name can't be derived — UIs fall back to `orgName`.
     */
    spaces?: Array<{
        id: string;
        name: string;
    }>;
    orgKind?: string;
    subscription?: string;
    subscriptionLevel?: string;
    subscriptionName?: string;
    isEnterprise?: boolean;
    isFreeAccount?: boolean;
}
export interface BrowserConnectionArgs {
    sessionId?: string;
    projectId?: string;
    branchName?: string;
    proxyOrigin?: string;
    proxyDefaultOrigin?: string;
    proxyDestination?: string;
}
export declare function signBuilderProvisioningToken(ownerEmail: string, sessionToken: string): string;
export declare function verifyBuilderProvisioningToken(token: string | null | undefined, ownerEmail: string, sessionToken: string | null | undefined): boolean;
export declare function signBuilderCallbackState(sessionEmail: string): string;
export declare function verifyBuilderCallbackState(token: string | null | undefined, sessionEmail: string): boolean;
export declare function verifyBuilderCallbackStateAndGetOwner(token: string | null | undefined): string | null;
export declare function signBuilderConnectToken(ownerEmail: string): string;
export declare function verifyBuilderConnectToken(token: string | null | undefined, ownerEmail: string): boolean;
export declare function verifyBuilderConnectTokenAndGetOwner(token: string | null | undefined): string | null;
export declare function appendBuilderConnectToken(connectUrl: string, ownerEmail: string): string;
export declare function getBuilderAppHost(): string;
export declare function getBuilderApiHost(): string;
export declare function getBuilderBranchProjectId(): string;
export declare function isBuilderBranchingEnabled(): boolean;
type BuilderBranchProjectProvider = () => string | undefined | Promise<string | undefined>;
/**
 * A host that binds each view to a Builder project (Design, mounted inside
 * Builder) names that project here, so a code-change handoff targets the
 * project the user is looking at rather than one deployment-wide setting.
 * Return `undefined` when the request has no bound project; the usual
 * Dispatch, env and secret lookups then apply. See
 * `resolveBuilderHandoffProjectId`.
 */
export declare function registerBuilderBranchProject(provider: BuilderBranchProjectProvider | null): void;
export declare function resolveBuilderBranchProjectId(): Promise<string>;
/**
 * The project a code-change handoff targets: the one the host binds to the
 * current view when it names one, otherwise the deployment's configured
 * project. Only the handoff uses this. Realtime channels and Builder status
 * keep the deployment's project, so a view bound elsewhere cannot move them.
 */
export declare function resolveBuilderHandoffProjectId(): Promise<string>;
export declare function resolveIsBuilderBranchingEnabled(): Promise<boolean>;
export declare const BUILDER_OPENER_PARAM = "_an_opener";
/**
 * Build the Builder cli-auth URL for the connect popup. When a signed
 * `state` token is supplied it is embedded inside the `redirect_url` query
 * string. The connect route also stores it in an HttpOnly cookie because
 * Builder may strip the callback query while appending its response params.
 *
 * Status responses can surface this URL directly; the legacy
 * `/_agent-native/builder/connect` trampoline still calls this helper for
 * clients that only know the app-local connect URL.
 */
export declare function buildBuilderCliAuthUrl(callbackOrigin: string, state?: string | null, options?: {
    previewOrigin?: string;
    relayState?: string;
    tracking?: BuilderConnectTrackingParams;
}): string;
export declare function getBuilderBrowserConnectUrl(origin: string): string;
export declare function getBuilderBrowserConnectUrlForOwner(origin: string, ownerEmail: string | null | undefined): string;
export declare function getBuilderConnectCallbackOriginFromUrl(callbackUrl: string): string | null;
export declare function getBuilderBrowserOriginForEvent(event: H3Event): string;
export declare function getBuilderCliAuthCallbackOriginForEvent(event: H3Event): string;
export declare function getBuilderBrowserStatus(origin: string): BuilderBrowserStatus;
export declare function getBuilderBrowserStatusForEvent(event: H3Event): BuilderBrowserStatus;
export declare const BUILDER_ENV_KEYS: readonly ["BUILDER_PRIVATE_KEY", "BUILDER_PUBLIC_KEY", "BUILDER_USER_ID", "BUILDER_ORG_NAME", "BUILDER_ORG_KIND", "BUILDER_SUBSCRIPTION", "BUILDER_SUBSCRIPTION_LEVEL", "BUILDER_SUBSCRIPTION_NAME", "BUILDER_IS_ENTERPRISE", "BUILDER_IS_FREE_ACCOUNT"];
export type BuilderEnvKey = (typeof BUILDER_ENV_KEYS)[number];
export declare function getBuilderCallbackEnvVars(params: {
    privateKey?: string | null;
    publicKey?: string | null;
    userId?: string | null;
    orgName?: string | null;
    orgKind?: string | null;
    subscription?: string | null;
    subscriptionLevel?: string | null;
    subscriptionName?: string | null;
    isEnterprise?: boolean | null;
    isFreeAccount?: boolean | null;
}): {
    key: "BUILDER_IS_ENTERPRISE" | "BUILDER_IS_FREE_ACCOUNT" | "BUILDER_ORG_KIND" | "BUILDER_ORG_NAME" | "BUILDER_PRIVATE_KEY" | "BUILDER_PUBLIC_KEY" | "BUILDER_SUBSCRIPTION" | "BUILDER_SUBSCRIPTION_LEVEL" | "BUILDER_SUBSCRIPTION_NAME" | "BUILDER_USER_ID";
    value: string;
}[];
export declare function resolveSafePreviewUrl(previewUrl: string | null | undefined, event: H3Event): string;
export declare function resolveBuilderPreviewRelayParentOrigin(options: {
    openerOrigin?: string | null;
    targetOrigin: string;
}): string;
export declare function resolveBuilderCallbackReturnUrl(options: {
    event: H3Event;
    openerOrigin?: string | null;
    previewUrl?: string | null;
}): string;
export declare function createBuilderBrowserCallbackPage(previewUrl: string, opts?: {
    parentOrigin?: string;
    attemptId?: string;
}): string;
export declare function createBuilderBrowserCallbackErrorPage(message: string, opts?: {
    title?: string;
    body?: string;
    closeHint?: string;
    parentOrigin?: string;
    code?: string;
    attemptId?: string;
}): string;
export declare const BUILDER_UPSTREAM_FAILURE_STATUS = 503;
export declare function cdnSafeOriginStatus(status: number): number;
export declare function sendBuilderPopupErrorPage(event: H3Event, status: number, message: string, opts?: Parameters<typeof createBuilderBrowserCallbackErrorPage>[1]): string;
export interface BuilderAgentUploadAttachment {
    type: "upload";
    contentType: "image/webp" | "image/png" | "image/jpeg" | "image/gif" | "application/pdf" | "application/json" | "text/plain";
    name: string;
    dataUrl: string;
    text?: string;
    id: string;
}
export interface BuilderAgentUrlAttachment {
    type: "url";
    value: string;
}
export type BuilderAgentAttachment = BuilderAgentUploadAttachment | BuilderAgentUrlAttachment;
export type BuilderAgentWireAttachment = (BuilderAgentUploadAttachment & {
    size: number;
}) | BuilderAgentUrlAttachment;
export interface RunBuilderAgentArgs {
    prompt: string;
    context?: string;
    attachments?: BuilderAgentAttachment[];
    projectId?: string;
    branchName?: string;
    userEmail?: string;
    userId?: string;
}
export declare const BUILDER_AGENT_CONTEXT_MAX_CHARS = 32000;
export declare function normalizeBuilderAgentAttachments(attachments: BuilderAgentAttachment[] | undefined): BuilderAgentWireAttachment[] | undefined;
export declare function normalizeBuilderAgentContext(value: unknown): string | undefined;
export declare function buildBuilderAgentUserPrompt(prompt: string, context?: string): string;
export interface RunBuilderAgentResult {
    branchName: string;
    projectId: string;
    url: string;
    status: string;
}
export interface BuilderProjectLookupArgs {
    repoUrl: string;
}
export interface BuilderProjectResult {
    projectId: string;
    name: string;
    repoUrl?: string;
    browserUrl: string;
    created: boolean;
}
export declare function isBuilderAccountProvisioningEnabled(): boolean;
export declare function provisionBuilderAccount(input: {
    email: string;
    name?: string;
    agentNativeApp?: string;
    agentNativeTemplate?: string;
}): Promise<BuilderRelayCredentials>;
/** @deprecated Repository-backed Builder projects are retained for compatibility. */
export declare function findBuilderProjectForRepo(args: BuilderProjectLookupArgs): Promise<BuilderProjectResult | null>;
export declare function createBuilderProject(args: {
    name: string;
    templateId?: string;
    repoUrl?: string;
}): Promise<BuilderProjectResult>;
/** @deprecated Repository-backed Builder projects are retained for compatibility. */
export declare function ensureBuilderProject(args: {
    name: string;
    repoUrl: string;
}): Promise<BuilderProjectResult>;
export declare function runBuilderAgent(args: RunBuilderAgentArgs): Promise<RunBuilderAgentResult>;
export declare function requestBuilderBrowserConnection(args: BrowserConnectionArgs): Promise<Record<string, unknown>>;
export {};