import DataLoader from 'dataloader';
import { TenantAwareDBClient } from '../../app-providers/tenant-db-client.js';
import { AuthContextProvider } from '../../auth/providers/auth-context.provider.js';
import type { AdminContext, IGetAdminContextsResult, IUpdateAdminContextParams } from '../types.js';
export declare class AdminContextProvider {
    private authContextProvider;
    private db;
    private authContext;
    private authContextInitialized;
    private cachedContext;
    private cachedContextInitializing;
    constructor(authContextProvider: AuthContextProvider, db: TenantAwareDBClient);
    normalizeContext(rawContext: IGetAdminContextsResult): AdminContext;
    /**
     * Every per-security business is an internal wallet too.
     *
     * A securities trade's counterparty is the security it traded rather than the general
     * foreign-securities business, and `internalWalletsIds` is what decides that a securities
     * movement is internal — it drives the ledger's counterparty override, fee classification,
     * and the balance report's internal-transfer filter. Leaving the securities out would change
     * all three the moment a transaction points at one.
     *
     * `normalizeContext` stays synchronous and pure; the enrichment happens on the async paths
     * that read from the DB anyway.
     */
    private securityBusinessIdsByOwner;
    private withSecurityBusinesses;
    private withOwnSecurityBusinesses;
    getAdminContext(): Promise<AdminContext | null>;
    getVerifiedAdminContext(): Promise<AdminContext>;
    updateAdminContext(params: IUpdateAdminContextParams): Promise<AdminContext | null>;
    private batchAdminContextsByOwnerIds;
    adminContextByOwnerIdLoader: DataLoader<string, AdminContext | null, string>;
    clearCache(): void;
    /**
     * Resolve the owner business for this request.
     * - Single-business read scope selects that business.
     * - Multi-business scope prefers the primary tenant business only when it is
     *   part of the scope; otherwise the first scoped business is used.
     * - No scope falls back to the primary tenant business.
     */
    private resolveOwnerIdForRequest;
    /**
     * Lazy initialization of auth context on first use.
     * This ensures the async provider is called only when needed.
     */
    private ensureAuthContext;
}