export declare const CANONICAL_IDENTITY_SSO_HUB_URL = "https://dispatch.agent-native.com";
export declare const NETLIFY_PREVIEW_IDENTITY_SSO_HUB_URL = "https://beta.dispatch.agent-native.com";
export declare const SSO_STATE_TTL_MS: number;
export declare const SSO_LOGIN_MAX = 60;
export declare const SSO_LOGIN_WINDOW_MS = 60000;
export declare function getIdentityHubUrl(): string | undefined;
export declare function isIdentitySsoExplicitlyEnabled(): boolean;
export declare function isIdentitySsoEnabled(): boolean;
export declare function isDesktopSsoCanaryUserAgent(userAgent: string | undefined): boolean;
export declare function isDesktopSsoUserAgent(userAgent: string | undefined): boolean;
export declare function isCanonicalAgentNativeAppOrigin(origin: string | undefined): boolean;
export declare function isCanonicalIdentitySsoClientOrigin(origin: string | undefined): boolean;
export declare function isCanonicalIdentitySsoClientConfigured(): boolean;
export declare function isCanonicalAgentNativeAppRequest(host: string | undefined, forwardedProtocol: string | undefined): boolean;
export declare function isCanonicalIdentitySsoClientRequest(host: string | undefined, forwardedProtocol: string | undefined): boolean;
export declare function isNetlifyDeployPermalinkIdentitySsoClientRequest(host: string | undefined, forwardedProtocol: string | undefined): boolean;
export declare function isNetlifyDeployPermalinkGoogleOAuthClientRequest(host: string | undefined, forwardedProtocol: string | undefined): boolean;
export declare function isNetlifyDeployPermalinkIdentitySsoClientOrigin(origin: string | undefined): boolean;
export declare function isNetlifyDeployPermalinkGoogleOAuthClientOrigin(origin: string | undefined): boolean;
export declare function isIdentitySsoAvailableForRequest(options?: {
    requestHost?: string;
    requestProtocol?: string;
}): boolean;
/** @deprecated Browser sign-in with Agent-Native was removed. */
export declare function identitySsoLoginButtonHtml(_options?: {
    requestHost?: string;
}): string;
export interface CreateSsoStateInput {
    returnPath: string | null;
    appId: string;
    clientId: string;
    redirectUri: string;
    authority: string;
    codeChallenge: string;
}
export interface SsoStateBinding {
    appId: string;
    clientId: string;
    redirectUri: string;
    authority: string;
    codeChallenge: string;
}
export interface SsoStateConsumeResult {
    ok: boolean;
    returnPath: string | null;
}
export declare const identitySsoStore: import("../db/store-registry.js").Store;
export declare function ensureTable(): Promise<void>;
export declare function createSsoState(input: CreateSsoStateInput): Promise<string>;
/**
 * Atomically consume state only when every security binding still matches.
 * A missing or mismatched binding is indistinguishable from an unknown state.
 */
export declare function consumeSsoState(state: string, expected: SsoStateBinding): Promise<SsoStateConsumeResult>;
export declare function consumeOneTimeJti(jti: string | undefined): Promise<boolean>;
export declare const isJtiReplayed: typeof consumeOneTimeJti;