import { DBProvider } from '../../app-providers/db.provider.js';
import { AuditLogsProvider } from '../../common/providers/audit-logs.provider.js';
import { Auth0ManagementProvider } from './auth0-management.provider.js';
export declare class AcceptInvitationsProvider {
    private dbProvider;
    private auth0ManagementProvider;
    private auditLogsProvider;
    constructor(dbProvider: DBProvider, auth0ManagementProvider: Auth0ManagementProvider, auditLogsProvider: AuditLogsProvider);
    acceptInvitation(token: string, auth0UserId: string | null, authenticatedUserEmail: string | null): Promise<{
        success: boolean;
        businessId: string;
        roleId: string;
    }>;
    /**
     * Accept an invitation the caller was matched to by verified email, without
     * the emailed token.
     *
     * Invitation tokens are stored hashed, so a listed invitation cannot be turned
     * back into its token — this is the lookup for a caller who never had (or lost)
     * the link. Where `acceptInvitation` treats possession of the token as the
     * proof, here the *only* proof is the verified email, so the caller's identity
     * must carry a verified address and it must match the invitation's. The shared
     * check in `finalizeAcceptance` enforces the match; requiring verification is
     * this method's job.
     */
    claimInvitation(invitationId: string, identity: {
        auth0UserId: string;
        email: string | null;
        emailVerified: boolean;
    }): Promise<{
        success: boolean;
        businessId: string;
        roleId: string;
    }>;
    /**
     * Shared tail of both acceptance paths: verify the claimant, link the user to
     * the business, clean up the pre-registered Auth0 user, and mark the
     * invitation accepted. Runs inside the caller's transaction; the caller
     * commits.
     */
    private finalizeAcceptance;
}