import type { ScopeContext } from "./types.js";
/**
 * Reject unusable scope ids at bind time. Scope ids are
 * platform-issued opaque identifiers (Cognito subs, app ids) —
 * whitespace or control characters in one is always a wiring bug,
 * and catching it here beats a scope-ambiguity bug in storage.
 * Shared by `withGuueyContext` and `createGuueyState` so both
 * entry points enforce the same contract.
 */
export declare function validateContext(context: ScopeContext): void;
/**
 * Run `fn` with the given scope context bound to AsyncLocalStorage.
 * Nested calls override the outer context for their lifetime.
 *
 * The MCP server frameworks (express/fastify/hono middleware,
 * `@modelcontextprotocol/sdk` transports) call this once per
 * incoming request after extracting the user/mcp ids from headers
 * or the SDK's session context.
 */
export declare function withGuueyContext<T>(context: ScopeContext, fn: () => T | Promise<T>): Promise<T>;
/**
 * Current scope context, or `undefined` if none is bound. The
 * library's barrel-exported `kv` calls this on every operation
 * and throws `MissingContextError` when it returns `undefined`.
 */
export declare function getCurrentContext(): ScopeContext | undefined;
/**
 * Derive a ScopeContext from the Authorization header guuey sent this
 * MCP server. Decodes WITHOUT verifying — the KV API is the verifier;
 * this is DX so `withGuueyContext(scopeFromAuthorization(h), fn)` is
 * one line. mcpId = "mcp_" + first 32 hex of sha256(canonical aud URL),
 * identical to the server derivation (auth.ts — keep in sync).
 */
export declare function scopeFromAuthorization(header: string): ScopeContext;
/** Canonicalize + hash a resource URL into a scope-safe mcpId. */
export declare function mcpIdFromResourceUrl(url: string): string;
//# sourceMappingURL=context.d.ts.map