import { MobileAuthService, MobileAuthServiceOptions } from '../services/MobileAuthService.js';
import { SessionPermissionRuntimeContext } from '../services/SessionPermissionContext.js';
/**
 * Minimal structural slice of SvelteKit's `RequestEvent` these handlers
 * touch (kept structural so `@sveltejs/kit` stays out of the dependency
 * tree, like the rest of this package's SvelteKit integration).
 */
export interface MobileRequestEvent {
    request: Request;
    getClientAddress?: () => string;
    locals?: Record<string, unknown>;
}
export type MobileRequestHandler = (event: MobileRequestEvent) => Promise<Response>;
export interface CreateMobileAuthHandlersOptions extends MobileAuthServiceOptions {
    /**
     * Enter smrt-tenancy request context for guarded routes when the session
     * carries a tenant (default true — mobile domain routes are expected to
     * hit `@TenantScoped` models).
     */
    enterTenantContext?: boolean;
    /** Enforce Postgres RLS via request-scoped transactions in guarded routes. */
    postgresRls?: boolean;
}
/** The mounted `/api/mobile` handler set. */
export interface MobileAuthHandlers {
    /** `POST /api/mobile/auth/start` */
    authStart: MobileRequestHandler;
    /** `POST /api/mobile/auth/complete` */
    authComplete: MobileRequestHandler;
    /** `GET /api/mobile/session` + `DELETE /api/mobile/session` */
    session: {
        GET: MobileRequestHandler;
        DELETE: MobileRequestHandler;
    };
    /**
     * Bearer-auth middleware for app-owned mobile routes: resolves the
     * `Authorization: Bearer` session, establishes the request permission
     * context ({@link withSessionPermissionContext} — so
     * `assertOperationPermission`, tenancy interceptors, and Postgres RLS all
     * see the caller), populates `event.locals` like the cookie session
     * handler does, and maps auth/permission failures to the JSON + status
     * semantics the mobile client expects (401 → client clears its session
     * and re-authenticates; 403 carries a machine-readable `reason`).
     */
    withSession: (event: MobileRequestEvent, fn: (event: MobileRequestEvent, context: SessionPermissionRuntimeContext) => Promise<Response>) => Promise<Response>;
    /** Route-wrapper form of {@link MobileAuthHandlers.withSession}. */
    guard: (fn: (event: MobileRequestEvent, context: SessionPermissionRuntimeContext) => Promise<Response>) => MobileRequestHandler;
    /** The lazily-created underlying service (shared by all handlers). */
    getService: () => Promise<MobileAuthService>;
}
/**
 * Build the mountable `/api/mobile` handler set. Call ONCE per app (module
 * scope) and export the members from the route files — the returned handlers
 * share one lazily-initialized {@link MobileAuthService}.
 */
export declare function createMobileAuthHandlers(options: CreateMobileAuthHandlersOptions): MobileAuthHandlers;
/**
 * Resolve the dedup key for a mobile multipart upload per the documented
 * contract (`docs/content/architecture/mobile-upload-contract.md`): the
 * `clientCaptureId` form field wins; the `Idempotency-Key` header — which
 * the shared mobile client sets to the durable queue entry's id — is the
 * fallback. Returns `null` when neither is present (the upload then has no
 * dedup guarantee).
 */
export declare function resolveMobileUploadDedupKey(formData: FormData | null, headers: Headers, fieldName?: string): string | null;
//# sourceMappingURL=mobile-handlers.d.ts.map