import { type ProviderIdentity } from "./provider.js";
/**
 * Become two real signed-in Firebase Auth users.
 *
 * Alone among the four, this needs no admin credential at all. Firebase's
 * Identity Toolkit REST API creates an email/password account and hands back an
 * ID token in one call, authenticated by the project's Web API key — the same
 * key that ships in the browser bundle, so it is public by construction and is
 * not a secret this run is being trusted with.
 *
 *   1. `POST https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=…`
 *      with `{ email, password, returnSecureToken: true }` returns
 *      `{ idToken, email, refreshToken, expiresIn, localId }`. `localId` is the
 *      uid — the `sub` of every token, and what an application's owner column
 *      holds.
 *   2. `POST .../v1/accounts:lookup?key=…` with `{ idToken }` returns
 *      `{ users: [{ localId, email, … }] }`. That is Firebase's own statement
 *      of whom the token authenticates, and it has to be the account just
 *      created or nothing is claimed.
 *   3. The application takes the ID token as `Authorization: Bearer <idToken>`,
 *      which is what the Admin SDK's `verifyIdToken` expects.
 *
 * Endpoint shapes, payload fields and error codes read from
 * https://firebase.google.com/docs/reference/rest/auth (sections "Sign up with
 * email / password" and "Get user data") and the same surface documented as
 * Google Identity Platform at
 * https://docs.cloud.google.com/identity-platform/docs/reference/rest/v1/accounts/signUp
 * and .../accounts/lookup.
 *
 * Firebase assigns `localId`, so, exactly as with Clerk, these users are
 * created before anything is seeded and their ids become the personas' ids.
 *
 * The Admin SDK route — minting a custom token with a service account's private
 * key and exchanging it at `accounts:signInWithCustomToken` — is deliberately
 * not taken. It works, and it would mean handling a developer's real private
 * key for no gain over a public key that already does the job.
 */
export interface FirebaseAuth {
    kind: "firebase_auth";
    /** The project's Web API key. Public by construction: it ships in the client bundle. */
    apiKey: string;
    /** Override for the Identity Toolkit root. Defaults to the Google-hosted one. */
    apiUrl?: string;
    /** The Identity Platform tenant, for a multi-tenant project. */
    tenantId?: string;
}
export declare function becomeFirebaseUsers(auth: FirebaseAuth): Promise<ProviderIdentity>;