import type { Request } from 'express';
import type { AuthConfig } from './config/AuthConfig.js';
import type { Authenticatable } from './contracts/Authenticatable.js';
import type { Guard } from './contracts/Guard.js';
import type { StatefulGuard } from './contracts/StatefulGuard.js';
import type { UserProvider } from './contracts/UserProvider.js';
import type { AuthEventDispatcher } from './events/AuthEventDispatcher.js';
import type { HashManager } from './hashing/HashManager.js';
import type { JwtBlacklist } from './jwt/JwtBlacklist.js';
import type { JwtProvider } from './jwt/JwtProvider.js';
import type { RefreshTokenRepository } from './jwt/RefreshTokenRepository.js';
import type { TokenAttemptResult } from './jwt/TokenAttemptResult.js';
import type { TokenPair } from './jwt/TokenPair.js';
import type { PasswordBroker } from './passwords/PasswordBroker.js';
import type { SocialProvider, SocialUser } from './providers/SocialProvider.js';
import type { SessionManager } from './session/SessionManager.js';
export type GuardFactory = (guardName: string, cfg: AuthConfig, req: Request) => Guard | StatefulGuard;
export type UserProviderFactory = (providerName: string) => UserProvider;
/**
 * Resolves a verified social provider profile into an application authenticatable user.
 */
export type SocialUserResolver<TSocialUser extends SocialUser = SocialUser> = (socialUser: TSocialUser) => Promise<Authenticatable>;
/**
 * Multi-guard authentication facade (session + JWT).
 */
export declare class AuthManager {
    private readonly config;
    private readonly hash;
    private readonly jwt;
    private readonly refreshRepo;
    private readonly jwtBlacklist;
    private readonly dispatch;
    private readonly baseUserProviderFactory;
    private readonly userProviderOverrides;
    private readonly guardCache;
    private readonly extended;
    private readonly brokerManager;
    /**
     * @param config - Merged auth configuration.
     * @param hash - Hash manager.
     * @param jwt - JWT provider.
     * @param refreshRepo - Refresh-token repository.
     * @param jwtBlacklist - Optional blacklist facade.
     * @param sessionManager - Session factory.
     * @param dispatch - Auth event dispatcher.
     * @param userProviderFactory - Builds {@link UserProvider} instances by configured provider name.
     * @param passwordBrokers - Named password brokers (reset flows).
     */
    constructor(config: AuthConfig, hash: HashManager, jwt: JwtProvider, refreshRepo: RefreshTokenRepository, jwtBlacklist: JwtBlacklist | null, sessionManager: SessionManager, dispatch: AuthEventDispatcher, userProviderFactory: UserProviderFactory, passwordBrokers: Record<string, PasswordBroker>);
    /**
     * Resolves a guard, caching per HTTP request.
     *
     * @param name - Guard key; defaults to `auth.defaults.guard`.
     */
    guard(name?: string): Guard | StatefulGuard;
    /**
     * Marks which guard authenticated the current request (used by middleware).
     *
     * @param name - Guard key.
     */
    shouldUse(name: string): void;
    /**
     * Attempts login on the default guard (session boolean, JWT returns a token bundle + user).
     */
    attempt(credentials: Record<string, unknown>, remember?: boolean): Promise<boolean | TokenAttemptResult | null>;
    /**
     * Runs a credential check against the preferred token guard (`api` or first `token` driver).
     */
    attemptWithTokens(credentials: Record<string, unknown>): Promise<TokenAttemptResult | null>;
    /**
     * Verifies a social provider token and resolves it into an application user.
     *
     * @param provider - Social provider implementation that verifies the token.
     * @param token - Provider-issued token.
     * @param resolveUser - Application-owned resolver that finds or creates an authenticatable user.
     * @returns The resolved application user.
     */
    socialLogin<TSocialUser extends SocialUser>(provider: SocialProvider<TSocialUser>, token: string, resolveUser: SocialUserResolver<TSocialUser>): Promise<Authenticatable>;
    /**
     * @inheritdoc StatefulGuard.login
     */
    login(user: Authenticatable, remember?: boolean): Promise<void>;
    /**
     * @inheritdoc StatefulGuard.loginUsingId
     */
    loginUsingId(id: string | number, remember?: boolean): Promise<Authenticatable | false>;
    /**
     * @inheritdoc StatefulGuard.logout
     */
    logout(): Promise<void>;
    /**
     * @inheritdoc Guard.user
     */
    user(): Promise<Authenticatable | null>;
    /**
     * @inheritdoc Guard.id
     */
    id(): Promise<string | number | null>;
    /**
     * @inheritdoc Guard.check
     */
    check(): Promise<boolean>;
    /**
     * @inheritdoc Guard.guest
     */
    guest(): Promise<boolean>;
    /**
     * @inheritdoc Guard.hasUser
     */
    hasUser(): boolean;
    /**
     * @inheritdoc Guard.setUser
     */
    setUser(user: Authenticatable): void;
    /**
     * @inheritdoc SessionGuard.viaRemember when session guard is default.
     */
    viaRemember(): boolean;
    /**
     * Refreshes JWTs using the default token guard.
     */
    refresh(refreshToken: string): Promise<TokenPair>;
    /**
     * Blacklists a JWT by opaque token string when enabled.
     */
    invalidateToken(token: string): Promise<void>;
    /**
     * @param name - Password broker key.
     */
    broker(name?: string): PasswordBroker;
    /**
     * @param provider - Provider key from `auth.providers`.
     */
    createUserProvider(provider?: string): UserProvider;
    /**
     * Registers a custom guard driver.
     */
    extend(driver: string, factory: GuardFactory): void;
    /**
     * Overrides user provider factory registration (advanced).
     */
    provider(name: string, factory: UserProviderFactory): void;
    /**
     * Clears per-request guard caches (tests).
     */
    forgetGuards(): void;
    /**
     * @returns Configured default guard key (`auth.defaults.guard`).
     */
    defaultGuardName(): string;
    private resolveTokenGuardName;
    private resolveGuard;
}
//# sourceMappingURL=AuthManager.d.ts.map