import { ExternalAuthorizeResult, VerifiedShopifyIdentity } from './types';
import { VerifyShopifyIdTokenOptions } from './verify';
export type AuthorizeShopifyIdentityOptions = {
    /** Fanfare secret key (sk_...). Server-side only — never expose to a browser. */
    secretKey: string;
    /** Fanfare consumer API base URL. */
    apiBaseUrl?: string;
    canonicalSubject?: string;
    /** Additional claims. `email`/`emailVerified` here are ignored — those are token-derived only. */
    claims?: Record<string, unknown>;
    fetch?: typeof fetch;
    /**
     * The device key thumbprint of the shopper's browser, read there with `getDeviceKeyThumbprint()`
     * from `@fanfare-io/fanfare-sdk-core/admission-proof` before sign-in starts and relayed to this
     * server. The exchange code is bound to that browser's device key, so only that browser, on the
     * origin that read the thumbprint, can redeem it with `exchangeExternal`.
     */
    jkt: string;
};
export declare function authorizeShopifyIdentity(identity: Pick<VerifiedShopifyIdentity, "issuer" | "subject"> & Partial<Pick<VerifiedShopifyIdentity, "email" | "emailVerified">>, options: AuthorizeShopifyIdentityOptions): Promise<ExternalAuthorizeResult>;
export type VerifyAndAuthorizeOptions = VerifyShopifyIdTokenOptions & Omit<AuthorizeShopifyIdentityOptions, "claims"> & {
    claims?: Record<string, unknown>;
};
export declare function verifyAndAuthorizeShopifySession(idToken: string, options: VerifyAndAuthorizeOptions): Promise<{
    identity: VerifiedShopifyIdentity;
    authorization: ExternalAuthorizeResult;
}>;