/**
 * Credentials DI Providers (Checkpoint 3b)
 *
 * Registers the per-request {@link CredentialsAccessor} (`this.credentials`).
 * The vault itself is a GLOBAL singleton owned by LocalPrimaryAuth; the accessor
 * is CONTEXT-scoped because it must resolve the CURRENT request's authenticated
 * subject (from {@link FrontMcpContext}) before reading the vault.
 */
import { type SessionCredentialVault } from '@frontmcp/auth';
import { type Token } from '@frontmcp/di';
import { type ProviderType } from '../../common';
import { type FrontMcpContext } from '../../context/frontmcp-context';
/**
 * GLOBAL DI token for the per-session credential vault singleton. Provided by
 * LocalPrimaryAuth once its storage backend is initialized.
 */
export declare const SESSION_CREDENTIAL_VAULT: Token<SessionCredentialVault>;
/**
 * Resolve the authenticated subject for the current request from the verified
 * auth info. The HTTP request flow stores the verified JWT user under
 * `authInfo.extra.user`; the JWT `sub` is the credential-vault key. Anonymous
 * sessions (`sub` empty or `anon:` prefixed) yield undefined so no credentials
 * are exposed.
 */
export declare function resolveRequestSub(ctx: FrontMcpContext): string | undefined;
/**
 * Build the DI providers that back `this.credentials`.
 *
 * @param vault - the GLOBAL credential vault singleton.
 * @param signingSecret - server HMAC secret used to sign resume tokens.
 * @param basePath - auth scope base path used to build resume URLs.
 * @param resumeTtlMs - optional resume-token TTL override.
 */
export declare function createCredentialsProviders(opts: {
    vault: SessionCredentialVault;
    signingSecret: string;
    basePath: string;
    resumeTtlMs?: number;
}): ProviderType[];
//# sourceMappingURL=credentials.providers.d.ts.map