/**
 * Supabase validated-token provider helpers.
 *
 * Authoring-time sugar for {@link ValidatedTokenProvider} configs that talk to
 * Supabase Auth (project refs, custom domains, multi-region introspection).
 */
import type { ValidatedTokenProvider } from "./types.js";
/**
 * A single Supabase region for multi-region introspection. A bare string is the
 * introspection URL (using the shared `${SUPABASE_ANON_KEY}`); an object pins a
 * `projectRef` or explicit `url`, plus an optional region-specific `anonKey`
 * (or raw `headers`) so each region uses its own project and anon key.
 */
export type SupabaseRegion = string | {
    projectRef?: string;
    url?: string;
    anonKey?: string;
    headers?: Record<string, string>;
};
/** Options for {@link supabaseProvider}. */
export interface SupabaseProviderOptions {
    projectRef?: string;
    /**
     * Project URL or custom auth domain (e.g. `https://auth.example.com`).
     * Sets `discoveryUrl` so the runtime resolves the real JWT `iss` + JWKS
     * via OIDC — vanity hosts are not the token issuer.
     */
    url?: string;
    introspect?: boolean;
    /**
     * Multi-region introspection: map each region to its Supabase project. A
     * string is a `projectRef`; an object can pin an explicit `url`/`anonKey` (so
     * each region uses its own project + anon key). Only valid with `introspect`.
     */
    regions?: Record<string, SupabaseRegion>;
    /** Client header carrying the region (default `x-supabase-region`). */
    regionHeader?: string;
}
/** Normalize a Supabase project or custom-domain URL to the `…/auth/v1` root. */
export declare function supabaseAuthV1Base(url: string): string;
/**
 * Build a Supabase {@link ValidatedTokenProvider}.
 *
 * @param options - Project ref, custom domain URL, and/or multi-region introspect.
 * @returns A plain provider object for `defineIdentity` / `validated_token`.
 */
export declare function supabaseProvider(options: SupabaseProviderOptions): ValidatedTokenProvider;
//# sourceMappingURL=supabase.d.ts.map