import type { SSOIdentity, LTSSOConfig } from '../../types/auth';
export interface ProvisionedUser {
    userId: string;
    roles: Array<{
        role: string;
        type: string;
    }>;
    created: boolean;
}
/**
 * JIT provision or sync an SSO identity to lt_users.
 *
 * Lookup by `external_id`. If not found, create with resolved roles.
 * If found, sync any new roles from the identity.
 *
 * Returns the internal `lt_users.id` (UUID) that all RBAC and
 * escalation queries use.
 */
export declare function ssoProvision(identity: SSOIdentity, ssoConfig: LTSSOConfig): Promise<ProvisionedUser>;