/**
 * The single "establish a session and return the user where they started"
 * primitive.
 *
 * Before this file the framework had five return-path validators, four
 * "don't redirect to yourself" checks, and two complete copies of the login
 * document — so every anti-loop fix landed on whichever fork the ticket named
 * and the reports never stopped. Every sign-in surface now calls exactly this:
 * the client gate (`RequireSession`), the login document, the sign-in entry
 * route, and every template button.
 *
 * The continuation is a PATH, never a URL, and it is carried opaquely in the
 * `c` query param. That combination is why nesting is structurally impossible
 * rather than guarded against:
 *
 *  - the grammar is not recursive: decoding a continuation yields a string,
 *    never another continuation;
 *  - `signInJourney` returns `signInHref: null` — no token at all — when the
 *    browser is already at an auth entry path, so the one function permitted
 *    to mint continuations refuses to mint the dangerous value;
 *  - the sign-in URL is `<base>/sign-in?c=<opaque>`, so
 *    "capture the current location as the return" has no URL-shaped input to
 *    re-encode;
 *  - `c` does not look like a URL, so Better Auth's `callbackURL`, a proxy, or
 *    a future patch cannot mistake it for a redirect target and wrap it.
 *
 * There is exactly ONE auth-entry-path predicate left in the codebase and it
 * lives in `normalizeAppPath` below. The four call-site copies are gone.
 *
 * Not signed. Signing buys nothing: the user already controls their own
 * browser and can type any URL. The only threat is open redirect, which is a
 * validation problem, not an integrity problem — and an HMAC would add a
 * secret dependency to code that must run inside a CDN-cached public document.
 */
export declare const SIGN_IN_CONTINUATION_PARAM = "c";
export declare const SIGN_IN_LEGACY_RETURN_PARAM = "return";
export declare const SIGN_IN_ENTRY_PATH = "/sign-in";
export declare const SIGN_IN_LEGACY_ENTRY_PATH = "/_agent-native/sign-in";
export declare const SIGN_IN_CONTINUATION_MAX_LENGTH = 512;
export declare function isVerificationLinkInvalid(error: string | null): boolean;
export interface SignInJourney {
    readonly signInHref: string | null;
    readonly resumeHref: string;
}
export interface SignInJourneyInput {
    at: string;
    continuation?: string | null;
    legacyReturn?: string | null;
    basePath?: string;
    homePath?: string;
}
export declare function normalizeAppPath(raw: string | null | undefined, basePath?: string): string | null;
export declare function encodeContinuation(path: string | null | undefined, basePath?: string): string;
export declare function decodeContinuation(token: string | null | undefined, basePath?: string): string | null;
export declare function signInJourney(input: SignInJourneyInput): SignInJourney;
/**
 * The runtime as `<script>`-embeddable source declaring
 * `__anCreateSignInJourney(basePath)`.
 *
 * Emitted from the same function the server and client call, so the login
 * document cannot drift from the module — which is exactly how the repo ended
 * up with two login pages disagreeing about return paths in the first place.
 * `packages/core` builds with plain `tsc` (no bundler, no minifier), so the
 * emitted source is verbatim; `createSignInJourneyRuntime` must therefore stay
 * self-contained, ES5-compatible, and free of references to module scope.
 */
export declare function signInJourneyInlineScript(): string;