import { AgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";

//#region src/auth/auth-config-utils.d.ts
declare function getInitialOrganization(dbClient: AgentsRunDatabaseClient, userId: string): Promise<{
  id: string;
} | null>;
/**
 * Build the list of trusted origins for Better Auth.
 * Includes static origins from env, SSO provider issuers from the DB,
 * and (for /sso/register POST requests) the issuer from the request body
 * so OIDC discovery is trusted before the provider is persisted.
 */
declare function getTrustedOrigins(dbClient: AgentsRunDatabaseClient, request: Request | undefined): Promise<string[]>;
/**
 * Extracts the root domain from a URL for cross-subdomain cookie sharing.
 *
 * When the API and UI share a common 3-part parent (e.g., api.pilot.inkeep.com
 * and pilot.inkeep.com both share .pilot.inkeep.com), the function auto-computes
 * the shared parent. When domains don't share a 3-part parent (e.g.,
 * api.agents.inkeep.com and app.inkeep.com), set AUTH_COOKIE_DOMAIN explicitly.
 *
 * Examples (auto-computed from baseURL):
 * - https://api.pilot.inkeep.com -> .pilot.inkeep.com
 * - https://pilot.inkeep.com -> .pilot.inkeep.com
 * - http://localhost:3002 -> undefined (no domain for localhost)
 *
 * With AUTH_COOKIE_DOMAIN=.inkeep.com:
 * - Any *.inkeep.com URL -> .inkeep.com
 */
declare function extractCookieDomain(baseURL: string, explicitDomain?: string): string | undefined;
declare function hasCredentialAccount(dbClient: AgentsRunDatabaseClient, userId: string): Promise<boolean>;
/**
 * Checks whether an SSO user should be auto-provisioned into an organization.
 * Reads the per-provider `autoProvision` flag from `allowedAuthMethods` JSON.
 * Returns false if:
 * - The provider has no organizationId or providerId
 * - The organization doesn't exist
 * - The SSO provider entry has autoProvision disabled (or is missing)
 * - The user is already a member
 */
declare function shouldAutoProvision(dbClient: AgentsRunDatabaseClient, user: {
  id: string;
  email: string;
}, provider: {
  organizationId?: string | null;
  providerId?: string;
}): Promise<boolean>;
//#endregion
export { extractCookieDomain, getInitialOrganization, getTrustedOrigins, hasCredentialAccount, shouldAutoProvision };