import type { HostAuthPreset, HostAuthPresetOptions } from "./shared.js";
/**
 * 09-vendo §2.1 — the Auth0 host-identity preset. Zero-argument in the
 * standard case: the tenant reads Auth0's own env (AUTH0_DOMAIN, or the v3
 * AUTH0_ISSUER_BASE_URL; AUTH0_AUDIENCE enforced when set), the session is
 * the Auth0-issued RS256 JWT presented as Authorization: Bearer and verified
 * against the tenant JWKS with the issuer check, and display derives from the
 * OIDC name/email claims. The optional subject→user resolver has the same
 * semantics as authJs (null = subject unknown → decline/null). The Auth0
 * SDK's encrypted `appSession` cookie is SDK-internal and stays with the
 * host's own middleware — it is not a verifiable token.
 *
 * Auth0 holds the private keys for its RS256 sessions, so the actAs half is
 * the shipped away-token producer (`auth0Preset`, 04 §2.1) — minting a
 * host-owned `VendoAway` token under VENDO_AWAY_TOKEN_SECRET; the matching
 * verify half stays host-mounted middleware (producer/verify split). The
 * `secret` option therefore overrides the AWAY-TOKEN secret (the preset's
 * system-equivalent shared secret).
 *
 * The door's sessionless redirect follows the Auth0 v4 SDK's route
 * convention: /auth/login, which natively honors returnTo.
 */
export declare function auth0(options?: HostAuthPresetOptions): HostAuthPreset;