import { OperationHttpHandler, type InteractionHandler, type OperationHttpHandlerInput, type ProviderFactory, type ResponseDescription } from '@solid/community-server';
import type { CookieStore } from '@solid/community-server';
interface AccountExistenceStorage {
    has: (type: string, id: string) => Promise<boolean>;
}
export interface ValidatingIdentityProviderHttpHandlerArgs {
    /**
     * Used to generate the OIDC provider.
     */
    providerFactory: ProviderFactory;
    /**
     * Used to determine the account of the requesting agent.
     */
    cookieStore: CookieStore;
    /**
     * Handles the requests.
     */
    handler: InteractionHandler;
    /**
     * Storage backing CSS account state.
     */
    accountStorage: AccountExistenceStorage;
    /**
     * External account authority (Cloud+Local mode). When set, account cookies
     * are issued and validated by the remote authority, so cookies unknown to
     * the local cookie store must be left untouched instead of expired.
     */
    externalAccountIssuer?: string;
}
/**
 * CSS-compatible IdP operation handler that drops stale account cookies.
 *
 * CSS trusts the account id stored in the cookie. In a clustered deployment where
 * account storage can be reset independently from browser cookies, that can leave
 * users stuck in a phantom logged-in state during registration or login.
 */
export declare class ValidatingIdentityProviderHttpHandler extends OperationHttpHandler {
    protected readonly logger: import("global-logger-factory").Logger<unknown>;
    private readonly providerFactory;
    private readonly cookieStore;
    private readonly handler;
    private readonly accountStorage;
    private readonly externalAccountIssuer?;
    constructor(args: ValidatingIdentityProviderHttpHandlerArgs);
    handle({ operation, request, response }: OperationHttpHandlerInput): Promise<ResponseDescription>;
    private findAccountCookies;
    private findAuthorizationAccountCookie;
    private findBrowserAccountCookie;
    private normalizeAccountCookie;
    private findValidAccount;
}
export {};