import { AgentsRunDatabaseClient } from "../../db/runtime/runtime-client.js";
import { AllowedAuthMethod, MethodOption, OrgAuthInfo } from "../../auth/auth-types.js";
import { UserOrganization } from "../../auth/auth-validation-schemas.js";

//#region src/data-access/runtime/organizations.d.ts

/**
 * Organization and Member data access layer
 * All database queries for Better Auth's organization/member tables
 */
/**
 * Get all organizations for a user
 * Queries Better Auth's member and organization tables
 * Returns Date for createdAt (converted to string at API boundary)
 */
declare const getUserOrganizationsFromDb: (db: AgentsRunDatabaseClient) => (userId: string) => Promise<Array<Omit<UserOrganization, "createdAt"> & {
  createdAt: Date;
}>>;
/**
 * Get pending invitations for a user by email
 * Returns invitations with status 'pending' that haven't expired
 */
declare const getPendingInvitationsByEmail: (db: AgentsRunDatabaseClient) => (email: string) => Promise<{
  id: string;
  email: string;
  organizationId: string;
  organizationName: string | null;
  organizationSlug: string | null;
  role: string | null;
  status: string;
  expiresAt: Date;
  inviterId: string;
  authMethod: string | null;
}[]>;
/**
 * Add user to organization
 * Directly inserts into Better Auth's member table
 */
declare const addUserToOrganization: (db: AgentsRunDatabaseClient) => (data: {
  userId: string;
  organizationId: string;
  role: string;
  isServiceAccount?: boolean;
}) => Promise<void>;
declare const upsertOrganization: (db: AgentsRunDatabaseClient) => (data: {
  organizationId: string;
  name: string;
  slug: string;
  logo?: string | null;
  metadata?: string | null;
}) => Promise<{
  created: boolean;
}>;
interface UserProviderInfo {
  userId: string;
  providers: string[];
}
/**
 * Get authentication providers for a list of users WITHIN an organization.
 * Returns which providers each member has linked (e.g., 'credential', 'google').
 * Results are scoped to members of `organizationId`; users outside it return no providers.
 */
declare const getUserProvidersFromDb: (db: AgentsRunDatabaseClient) => (userIds: string[], organizationId: string) => Promise<UserProviderInfo[]>;
declare const getAllowedAuthMethods: (db: AgentsRunDatabaseClient) => (organizationId: string) => Promise<AllowedAuthMethod[]>;
/**
 * Create an invitation directly in db.
 * Accepts an optional explicit authMethod; defaults to email-password.
 */
declare const createInvitationInDb: (db: AgentsRunDatabaseClient) => (data: {
  organizationId: string;
  email: string;
  authMethod?: string;
}) => Promise<{
  id: string;
  authMethod: string;
}>;
interface SSOProviderLookupResult {
  providerId: string;
  issuer: string;
  domain: string;
  organizationId: string | null;
  providerType: 'oidc' | 'saml';
}
declare const getSSOProvidersByDomain: (db: AgentsRunDatabaseClient) => (domain: string) => Promise<SSOProviderLookupResult[]>;
/**
 * Filters org-allowed auth methods by email domain.
 * SSO providers are only included if their domain matches the user's email domain.
 * Non-SSO methods (email-password, google) pass through unfiltered.
 */
declare const getFilteredAuthMethodsForEmail: (db: AgentsRunDatabaseClient) => (organizationId: string, email: string) => Promise<MethodOption[]>;
declare function allowedMethodsToMethodOptions(methods: AllowedAuthMethod[], ssoProviders: SSOProviderLookupResult[]): MethodOption[];
/**
 * Main auth-lookup query for the login flow.
 * Returns org-grouped methods based on SSO domain match and/or user org membership.
 */
declare const getAuthLookupForEmail: (db: AgentsRunDatabaseClient) => (email: string) => Promise<OrgAuthInfo[]>;
//#endregion
export { type MethodOption, type OrgAuthInfo, SSOProviderLookupResult, UserProviderInfo, addUserToOrganization, allowedMethodsToMethodOptions, createInvitationInDb, getAllowedAuthMethods, getAuthLookupForEmail, getFilteredAuthMethodsForEmail, getPendingInvitationsByEmail, getSSOProvidersByDomain, getUserOrganizationsFromDb, getUserProvidersFromDb, upsertOrganization };