import type { IDialect } from '@mostajs/orm';
export interface AuthGuardParams {
    /** Transport name — 'rest' | 'jsonrpc' | 'mcp' | 'sse' | 'trpc' | 'odata' | 'graphql' | 'ws' */
    transport: string;
    /** Operation family — read / write / admin (omit if you don't want to enforce) */
    operation?: 'read' | 'write' | 'admin';
    /** Allow request through without apikey (legacy / public-mode) */
    openMode?: boolean;
    /** Default project slug when not specified in headers */
    defaultProject?: string;
    /** When no apikey, fall back to a labeled apikey (typ. 'public-default'). */
    fallbackPublicLabel?: string;
}
export interface AuthGuardResult {
    ok: boolean;
    ctx?: any;
    status?: number;
    body?: any;
}
/**
 * Apply auth check on an incoming Fastify request. Use in route handlers :
 *
 *   const auth = await authGuard(dialect, req, { transport: 'jsonrpc' });
 *   if (!auth.ok) { reply.code(auth.status!); return auth.body; }
 *   // … use auth.ctx (apiKey, projectName, accountId, apikeyId, …)
 */
export declare function authGuard(dialect: IDialect | null | undefined, req: any, params: AuthGuardParams): Promise<AuthGuardResult>;