import type { ActorResolver } from '../spi/actor-resolver.js';
import type { Actor } from '../types.js';
import type { AuthzTenantScope } from './authz-tool-authorizer.js';
/**
 * The structural slice of `@adonis-agora/authz`'s `AuthzService` this resolver needs: the user's
 * effective roles (authz's union of global (context) ∪ app (`resolveRoles`) ∪ store (DB)). Typed
 * structurally so `@adonis-agora/authz` stays an OPTIONAL lazy peer — zero import of the package.
 */
export interface AuthzRolesSourceLike {
    effectiveRoles(user: unknown, scope?: AuthzTenantScope): Promise<string[]>;
}
/** Options for {@link AuthzActorResolver} / {@link authzActorResolver}. */
export interface AuthzActorResolverConfig {
    /** The `@adonis-agora/authz` `AuthzService` (or any structural match) the resolver reads roles from. */
    authz: AuthzRolesSourceLike;
}
/**
 * An {@link ActorResolver} that reads the caller from the Agora context authkit populates
 * (`userRef`, `tenantId`) and takes the caller's roles from authz (`effectiveRoles`). It ignores
 * the transport `req` and reads the active Agora context store, so it needs no `ctx.auth` and is
 * framework-agnostic.
 *
 * Security posture — FAIL-CLOSED: no `userRef.id` in context → throws (the provider replies 401).
 * An identity is never fabricated. The context `userRef` is passed straight to `effectiveRoles`;
 * authz reads its `.id`/`.type` and re-reads `globalRoles` from the same context, so global roles
 * (e.g. `ADMIN`) land in the result with no extra wiring.
 */
export declare class AuthzActorResolver implements ActorResolver {
    #private;
    constructor(config: AuthzActorResolverConfig);
    resolve(_req: unknown): Promise<Actor>;
}
/** Factory for {@link AuthzActorResolver}. */
export declare function authzActorResolver(config: AuthzActorResolverConfig): ActorResolver;
//# sourceMappingURL=authz-actor-resolver.d.ts.map