import type { RawAuth } from '../../../plugins/auth-plugin.js';
import type { AuthContext } from '../../../shared/types/auth.js';
import type { Environment } from '../../../shared/types/index.js';
import { DBProvider } from '../../app-providers/db.provider.js';
type QueryableDB = Pick<DBProvider, 'query'>;
type JwtIdentity = {
    auth0UserId: string;
    email: string | null;
    emailVerified: boolean;
};
export declare function handleDevBypassAuth(db: QueryableDB, userId: string): Promise<AuthContext | null>;
export declare class AuthContextProvider {
    private env;
    private rawAuth;
    private db;
    private cachedContext;
    private handlingAuth;
    private jwtIdentity;
    constructor(env: Environment, rawAuth: RawAuth, db: DBProvider);
    /**
     * The verified identity behind this request's JWT, or null.
     *
     * Memoized for the operation: the auth directives call this on every guarded
     * field that fails to resolve an auth context, so an unprovisioned user with a
     * multi-field query would otherwise pay for one `jwtVerify` per field. Caching
     * the promise (not the value) also collapses concurrent field resolution into a
     * single verification. Safe because `rawAuth` is fixed for the operation.
     */
    getJwtIdentity(): Promise<JwtIdentity | null>;
    private resolveJwtIdentity;
    getAuthContext(): Promise<AuthContext | null>;
    /**
     * Resolve the request's read scope and attach it to the context.
     *
     * - Defaults to every business the user belongs to.
     * - When a valid `X-Business-Scope` header is present, narrows to that subset;
     *   rejects (returns null) if it requests a business outside the memberships
     *   or if the header was malformed.
     * - API keys are pinned to their single business and ignore the header.
     */
    private applyRequestedReadScope;
    private handleDevBypassAuth;
    private handleApiKeyAuth;
    private resolveApiKeyContext;
    private handleGatewayControlPlaneAuth;
    private handleJwtAuth;
    private mapAuth0UserToLocal;
}
export {};