import { type ScopeHost } from '@substrat-run/kernel';
import { type ConnectUrlRelayResult, type PlatformActorId } from '@substrat-run/contracts';
/**
 * The connect-url relay (connections.md §3.5.3) — the OAuth half of §3.5.2's credential
 * relay. This module is `/internal/connections/connect-url`'s logic, kept out of the
 * worker so it can be exercised against a real adapter.
 *
 * A bookkeeping bureau's staff work inside the VERTICAL. They have no dashboard account,
 * they connect a new client company most weeks, and each one is its own Fortnox consent
 * round. The credential relay cannot serve them — there is no credential to paste until
 * the round has already happened — and the dashboard's connect link cannot either,
 * because minting one requires the dashboard session they do not have. So the round has
 * to be startable from where the work is, while everything that touches a credential
 * stays where it already is.
 *
 * What this returns is a URL. Not a token the vertical could spend, not a client id, not
 * a capability: the consent starts and ends on the platform's own origin — the one
 * `redirect_uri` registered with the provider — and the vertical's part is over the
 * moment it redirects its user. The authority behind the round is the `ctx.check` the
 * vertical's operation ran before calling, carried as `principal` in the signed state and
 * stamped on the connection as `createdBy` (§3.5.1).
 */
export declare class ConnectUrlRelayError extends Error {
    /** `503` when the DEPLOYMENT cannot run a round at all, the same distinction #603 drew. */
    readonly status: 400 | 404 | 503;
    constructor(message: string, 
    /** `503` when the DEPLOYMENT cannot run a round at all, the same distinction #603 drew. */
    status: 400 | 404 | 503);
}
/** Where a provider's platform-hosted consent round begins. */
export interface ConnectFlowSpec {
    /**
     * Absolute path on {@link ConnectUrlRelayOptions.connectOrigin} that starts the round
     * — e.g. `/api/integrations/fortnox/connect`. It takes the signed state as `?token=`
     * and redirects to the provider.
     */
    readonly startPath: string;
}
export interface ConnectUrlRelayOptions {
    /**
     * The origin hosting the consent round and the provider's registered `redirect_uri`
     * (`https://app.substrat.net`). A deployment fact, not a caller's choice: the whole
     * point is that every vertical's round lands on the ONE callback the provider knows.
     */
    connectOrigin?: string;
    /** The providers this deployment can run a round for. A provider absent here is a 404. */
    flows: Readonly<Record<string, ConnectFlowSpec | undefined>>;
    /** This deployment's `PLATFORM_SECRET` — the state's signing key (via HKDF). */
    platformSecret?: string;
}
export declare function relayConnectUrl(host: ScopeHost, actor: PlatformActorId, body: unknown, options: ConnectUrlRelayOptions): Promise<ConnectUrlRelayResult>;
//# sourceMappingURL=connect-url.d.ts.map