import type { BrightDb } from '@brightchain/db';
import type { SecureString } from '@digitaldefiance/ecies-lib';
import type { PlatformID } from '@digitaldefiance/node-ecies-lib';
import type { IAuthenticatedUser, IAuthenticationProvider, ICryptoAuthResult } from '@digitaldefiance/node-express-suite';
import type { IRequestUserDTO, ITokenUser } from '@digitaldefiance/suite-core-lib';
/**
 * Generic BrightDB-backed authentication provider.
 *
 * Provides basic user lookup from BrightDB `users` collection and JWT
 * token verification. Domain-specific auth (MemberStore, mnemonic auth,
 * password auth) is added by subclasses.
 */
export declare class BrightDbAuthenticationProvider<TID extends PlatformID = Buffer, TLanguage extends string = string> implements IAuthenticationProvider<TID, TLanguage> {
    protected readonly db: BrightDb;
    protected readonly jwtSecret: string;
    constructor(db: BrightDb, jwtSecret: string);
    /**
     * Find a user by ID from the `users` collection.
     * Subclasses override to try MemberStore first.
     */
    findUserById(userId: string): Promise<IAuthenticatedUser<TLanguage, TID> | null>;
    /**
     * Build a request user DTO from the `users` collection.
     * Subclasses override to try MemberStore first.
     */
    buildRequestUserDTO(userId: string): Promise<IRequestUserDTO | null>;
    /**
     * Verify a JWT token and return the decoded user.
     */
    verifyToken<TTokenUser extends ITokenUser = ITokenUser>(token: string): Promise<TTokenUser | null>;
    /**
     * Authenticate with a mnemonic and return the crypto result.
     * Base implementation throws — subclasses (e.g. BrightChainAuthenticationProvider)
     * override with MemberStore-backed mnemonic verification.
     */
    authenticateWithMnemonic(_email: string, _mnemonic: SecureString): Promise<ICryptoAuthResult<TID>>;
    /**
     * Authenticate with a password and return the crypto result.
     * Base implementation throws — subclasses override with real password verification.
     */
    authenticateWithPassword(_email: string, _password: string): Promise<ICryptoAuthResult<TID>>;
}
//# sourceMappingURL=bright-db-authentication-provider.d.ts.map