import type { ResolvedDashboardAuth } from '../auth/dashboard-auth-config.js';
import type { ResolvedCoreConfig } from '../config/options.js';
interface LoginBody {
    username?: unknown;
    password?: unknown;
}
/**
 * Mints/clears the dashboard session cookie. Mounted on a SEPARATE controller
 * from the gated API so it is NOT behind `TelescopeGuard` — these endpoints
 * CREATE the session the gate checks for.
 */
export declare class TelescopeAuthController {
    private readonly auth;
    private readonly config;
    private readonly logger;
    /** One warn per hook kind, so a flaky hook doesn't spam logs every request. */
    private readonly warnedHooks;
    constructor(auth: ResolvedDashboardAuth | null, config: ResolvedCoreConfig);
    session(request: unknown, response: unknown): Promise<void>;
    login(body: LoginBody, request: unknown, response: unknown): Promise<void>;
    logout(request: unknown, response: unknown): void;
    me(request: unknown): {
        user: {
            id: string;
            name?: string;
            roles: string[];
        };
    };
    private requireAuth;
    private mint;
    /**
     * Run a host hook defensively: a throw is treated as a denial (null) and
     * warn-logged once per kind, so a buggy hook never 500s the endpoint into a
     * stack leak nor floods the logs.
     */
    private runHook;
}
export {};
//# sourceMappingURL=telescope-auth.controller.d.ts.map