import type { H3Event } from "h3";
import { IDENTITY_SSO_PROVIDER_ID } from "./identity-sso-provider.js";
import { getIdentityHubUrl, identitySsoLoginButtonHtml, isIdentitySsoEnabled } from "./identity-sso-store.js";
export { getIdentityHubUrl, identitySsoLoginButtonHtml, isIdentitySsoEnabled };
export { IDENTITY_SSO_PROVIDER_ID };
export declare const IDENTITY_SSO_SCOPE = "identity";
export declare const IDENTITY_SSO_DESKTOP_COMPLETE_PATH = "/_agent-native/identity/desktop-complete";
export declare const IDENTITY_SSO_CALLBACK_PATH = "/_agent-native/identity/callback";
export declare const IDENTITY_SSO_TOKEN_PATH = "/_agent-native/identity/token";
export declare const IDENTITY_SSO_BOOTSTRAP_PATH = "/_agent-native/identity/bootstrap";
export declare const IDENTITY_SSO_BOOTSTRAP_ACTIVATE_PATH = "/_agent-native/identity/bootstrap/activate";
export declare const IDENTITY_SSO_BOOTSTRAP_SCOPE = "identity-bootstrap";
export declare const IDENTITY_SSO_BOOTSTRAP_BINDING_COOKIE = "an_identity_bootstrap_binding";
export declare function resolveIdentitySsoAppId(event: H3Event): string;
export declare function canIdentitySsoBootstrapBindingCookieReachHub(event: H3Event, hub: string): boolean;
export declare function setIdentitySsoBootstrapBindingCookie(event: H3Event, binding: string, hub: string): boolean;
export declare function getIdentitySsoBootstrapBindingCookie(event: H3Event): string | null;
export declare function clearIdentitySsoBootstrapBindingCookie(event: H3Event): void;
export declare function resolveIdentityHubUrl(event: H3Event): string | undefined;
/**
 * Ensure an authority-issued identity has a local Better Auth account.
 *
 * Provisioning goes through the password signup ceremony because that is the
 * only public API that runs Better Auth's user hooks, which leaves behind an
 * unusable credential the person never chose. Pass `emailVerified` whenever the
 * authority proved control of the address: without it the row stays unverified
 * forever, because the verification email points at a password nobody set. An
 * unverified row is not a cosmetic detail, it withholds pending invitations and
 * domain auto-join.
 */
export declare function ensureIdentityUser(email: string, name?: string, signupHeaders?: Headers, options?: {
    emailVerified?: boolean;
}): Promise<{
    id: string;
    emailVerified: boolean;
    accounts: Array<{
        providerId: string;
        accountId: string;
    }>;
}>;
export declare function handleIdentitySso(event: H3Event, subpath: string): Promise<Response>;
export declare function isIdentitySsoBypassPath(p: string): boolean;