import { User } from './types.js';
/**
 * Logger interface for FirebaseAuthTool
 */
export interface AuthLogger {
    info: (message: string, meta?: Record<string, unknown>) => void;
    warn: (message: string, meta?: Record<string, unknown>) => void;
}
export declare const setAuthLogger: (logger: AuthLogger) => void;
export declare class FirebaseAuthTool {
    private auth;
    private adminEmails;
    private adminDomains;
    private adminUids;
    private readonly allowTestTokens;
    private readonly testTokenMap;
    constructor();
    /**
     * Verify Firebase ID token and return user info
     */
    verifyIdToken(idToken: string): Promise<User>;
    /**
     * Create an anonymous user for unauthenticated requests
     *
     * @param clientUserId - Optional client-provided user ID for session continuity
     *                       If provided, enables anonymous users to continue conversations
     *                       across requests by maintaining the same user ID
     *
     * SECURITY: Client-provided IDs are namespaced with 'anon-' prefix to prevent
     *           collision with authenticated user IDs
     *
     * SESSION CONTINUITY: When clientUserId is provided, the same ID is returned
     *                     across multiple requests, enabling conversation threading
     *                     and proper rate limiting
     *
     * ISOLATION: When no clientUserId is provided, generates unique random ID
     *            to prevent data leakage between different anonymous users
     */
    createAnonymousUser(clientUserId?: string): User;
    /**
     * Check if user is an admin (for rate limiting)
     *
     * FIX: Added UID-based fallback to handle cases where Firebase token
     * does not contain email claim, preventing admin users from being
     * incorrectly treated as anonymous (which caused 5/hour rate limit).
     */
    isAdmin(user: User): boolean;
    /**
     * Generate authentication instructions for frontend
     */
    getAuthInstructions(): string;
    /**
     * Extract user from request headers
     *
     * @param headers - Request headers (may include Authorization, X-Client-User-Id)
     * @param clientUserId - Optional client-provided user ID for anonymous session continuity
     *
     * For anonymous users (no auth token), checks for:
     * 1. clientUserId parameter (from caller)
     * 2. X-Client-User-Id header (from HTTP request)
     *
     * This enables anonymous users to maintain the same identity across requests
     * for conversation continuity and rate limiting.
     */
    getUserFromRequest(headers: any, clientUserId?: string): Promise<User>;
    /**
     * Health check for Firebase Auth
     */
    healthCheck(): Promise<{
        status: string;
        details?: any;
    }>;
    private loadTestTokenMap;
    private resolveTestToken;
}
//# sourceMappingURL=FirebaseAuthTool.d.ts.map