/**
 * Tenancy-side authorization gate for cross-domain session handoff.
 *
 * The handoff MECHANISM (single-use codes, refresh-token exchange,
 * cookie minting) lives in `@venturekit/auth/server` — it is session
 * machinery and knows nothing about tenants. The QUESTION it delegates
 * — *"may this user get a session on that host?"* — is pure tenancy:
 * resolve the host to a tenant, check the user is an active tenant
 * user there. This factory packages that answer so apps don't
 * hand-roll host normalization and the fail-closed rules:
 *
 * ```ts
 * // app code
 * createSessionHandoffRoutes({
 *   store,
 *   authorize: createTenantHandoffAuthorize({
 *     resolveTenantByHost: (host) => loadByDomain(host),
 *     isActiveTenantUser: ({ tenantId, userSub }) =>
 *       hasApprovedMembership(tenantId, userSub),
 *   }),
 *   ...
 * });
 * ```
 *
 * Fail-closed by construction: unknown host → false, resolver error →
 * false is the CALLER's job to avoid (let errors propagate = request
 * fails, which is also closed), missing tenant user → false.
 */
/** Host → tenant resolution, app-provided (usually the same lookup the
 *  tenant middleware uses). Receives a bare lowercase hostname — no
 *  port, no `www.` prefix. Return null for unknown hosts. */
export type HandoffTenantResolver = (host: string) => Promise<{
    id: string;
} | null>;
export interface TenantHandoffAuthorizeOptions {
    /** Resolve the (normalized) target host to a tenant. */
    resolveTenantByHost: HandoffTenantResolver;
    /**
     * Is this user an ACTIVE tenant user of the resolved tenant?
     * Apps define "active" (approved, not suspended, not deleted, …) —
     * the same rule their scope middleware uses.
     */
    isActiveTenantUser: (args: {
        tenantId: string;
        userSub: string;
    }) => Promise<boolean>;
}
/**
 * Normalize a browser-facing host for tenant resolution: lowercase,
 * strip the port and a leading `www.`.
 */
export declare function normalizeHandoffHost(targetHost: string): string;
/**
 * Build an `authorize` function for
 * `@venturekit/auth/server`'s `createSessionHandoffRoutes`.
 */
export declare function createTenantHandoffAuthorize(options: TenantHandoffAuthorizeOptions): (args: {
    userSub: string;
    targetHost: string;
}) => Promise<boolean>;
//# sourceMappingURL=handoff-authorize.d.ts.map