import type { Request } from 'express';
import type { AuthConfig } from '../config/AuthConfig.js';
import type { Authenticatable } from '../contracts/Authenticatable.js';
import type { Guard } from '../contracts/Guard.js';
import type { UserProvider } from '../contracts/UserProvider.js';
import type { AuthEventDispatcher } from '../events/AuthEventDispatcher.js';
import { type JwtBlacklist } from '../jwt/JwtBlacklist.js';
import type { JwtProvider } from '../jwt/JwtProvider.js';
import { RefreshTokenRepository } from '../jwt/RefreshTokenRepository.js';
import type { TokenAttemptResult } from '../jwt/TokenAttemptResult.js';
import type { TokenPair } from '../jwt/TokenPair.js';
/**
 * JWT (Bearer) authentication guard.
 */
export declare class TokenGuard implements Guard {
    private readonly jwt;
    private readonly provider;
    private readonly request;
    private readonly blacklist;
    private readonly refreshRepo;
    private readonly config;
    private readonly dispatch;
    private readonly guardName;
    private cachedUser;
    /**
     * @param jwt - JWT signer/verifier.
     * @param provider - User lookup.
     * @param request - Current HTTP request.
     * @param blacklist - Optional blacklist when enabled in config.
     * @param refreshRepo - Refresh-token persistence.
     * @param config - JWT config slice.
     * @param dispatch - Event sink.
     * @param guardName - Registered guard key (for events).
     */
    constructor(jwt: JwtProvider, provider: UserProvider, request: Request, blacklist: JwtBlacklist | null, refreshRepo: RefreshTokenRepository, config: AuthConfig['jwt'], dispatch: AuthEventDispatcher, guardName: string);
    /**
     * @inheritdoc
     */
    check(): Promise<boolean>;
    /**
     * @inheritdoc
     */
    guest(): Promise<boolean>;
    /**
     * @inheritdoc
     */
    user(): Promise<Authenticatable | null>;
    /**
     * @inheritdoc
     */
    id(): Promise<string | number | null>;
    /**
     * @inheritdoc
     */
    validate(credentials: Record<string, unknown>): Promise<boolean>;
    /**
     * @inheritdoc
     */
    hasUser(): boolean;
    /**
     * @inheritdoc
     */
    setUser(user: Authenticatable): void;
    /**
     * Attempts credential login and returns JWT pair + user.
     *
     * @param credentials - Must include fields understood by the user provider (e.g. email/password).
     */
    attemptWithCredentials(credentials: Record<string, unknown>): Promise<TokenAttemptResult | null>;
    /**
     * Rotates refresh token according to {@link AuthConfig.jwt} rotation settings.
     *
     * @param refreshToken - Previously issued refresh JWT.
     * @returns New token pair.
     */
    refresh(refreshToken: string): Promise<TokenPair>;
    /**
     * Blacklists the current access token and revokes the refresh token when provided.
     */
    logout(): Promise<void>;
    /**
     * @returns Bearer token from header, `token` query param, or `token` cookie.
     */
    getTokenFromRequest(): string | null;
    private getRefreshFromRequest;
    private buildPair;
}
//# sourceMappingURL=TokenGuard.d.ts.map