import type { HostAuthPreset, HostAuthPresetOptions } from "./shared.js";
export interface SupabaseHostAuthPresetOptions extends HostAuthPresetOptions {
    /** GoTrue's JWKS URL for ES256 session verification. Default: derived from
        SUPABASE_URL as `<url>/auth/v1/.well-known/jwks.json` (GoTrue's own
        well-known path); pass this to point somewhere else. The thunk form
        resolves lazily per call (the SecretSource pattern), so composition
        order never races env loading. */
    jwks?: string | URL | (() => string | URL | undefined);
}
/**
 * 09-vendo §2.1 — the Supabase Auth host-identity preset. Zero-argument in
 * the standard case: it reads Supabase's own env, the session resolves off a
 * plain Request per Supabase's own formats (Authorization: Bearer, or the
 * `sb-*-auth-token` cookie — @supabase/ssr's `base64-`/chunked shape, the
 * legacy JSON shapes, and the raw access token), and display derives from
 * user_metadata.name/full_name/email. The optional subject→user resolver has
 * the same semantics as authJs (null = subject unknown → decline/null).
 *
 * Session verification is Supabase's documented HYBRID (the same one a
 * project with JWT signing keys needs), routed by the token's own `alg`:
 *
 * 1. HS256 first — the project's legacy JWT secret (SUPABASE_JWT_SECRET or
 *    `secret`), verified OFFLINE through the SAME shared `verifyHs256` the
 *    minting half targets: no network, no optional SDK, and every actAs-minted
 *    away token stays verifiable with no Supabase stack running.
 * 2. ES256 fallback — what `supabase start` ≥ v2.71 and hosted projects on
 *    the new key system sign interactive logins with, verified against
 *    GoTrue's JWKS (SUPABASE_URL → /auth/v1/.well-known/jwks.json, or the
 *    `jwks` option) through a lazily-imported jose (optional peer, cached
 *    remote key set per URL).
 *
 * Both paths enforce Supabase's `authenticated` audience, which is also what
 * keeps the project's API keys (anon/service_role — HS256 JWTs under the same
 * secret, but without that audience) from ever counting as a signed-in user.
 * Tokens neither path can verify resolve to null (no session); construction
 * with NEITHER a secret NOR a JWKS source fails loud, naming both.
 *
 * The actAs half IS the shipped `@vendoai/vendo/actions/presets` supabasePreset —
 * one minting story (04 §2.1), configured from these same options. Tokens
 * mint (and verify) under Supabase's `authenticated` audience convention.
 */
export declare function supabase(options?: SupabaseHostAuthPresetOptions): HostAuthPreset;