import type { QuotaType, QuotaService } from '@pipeline-builder/api-core';
import type { RequestHandler } from 'express';
/**
 * Creates a middleware chain for protected routes requiring authentication, org ID, and quota check.
 *
 * Applies middleware in order:
 * 1. requireAuth - Validates JWT and extracts user identity
 * 2. requireOrgId - Ensures request has x-org-id header
 * 3. idempotencyMiddleware - Dedupes keyed mutation retries (no-op without an
 *    Idempotency-Key header or on non-mutation methods)
 * 4. withTenantContext - Opens the RLS tenant scope (orgId + isSuperAdmin) for the request
 * 5. checkQuota - Validates quota for the specified resource type
 *
 * Idempotency sits AFTER auth+orgId (so it can namespace the replay cache on the
 * VERIFIED org — a pre-auth global mount saw no identity and was a permanent
 * no-op) and BEFORE withTenantContext/checkQuota (so a replayed request short-
 * circuits without opening an RLS scope or spending a quota check).
 *
 * @param quotaService - Quota service client
 * @param quotaType - Which quota to check (e.g., 'apiCalls', 'pipelines', 'plugins')
 * @returns Array of middleware handlers ready to spread into route definition
 *
 * @example
 * ```typescript
 * router.post('/',
 *   ...createProtectedRoute(quotaService, 'pipelines'),
 *   async (req, res) => {
 *     // Handler implementation
 *   }
 * );
 * ```
 */
export declare function createProtectedRoute(quotaService: QuotaService, quotaType: QuotaType): RequestHandler[];
/**
 * Creates a middleware chain for authenticated routes with org ID requirement but no quota check.
 *
 * Applies middleware in order:
 * 1. requireAuth - Validates JWT and extracts user identity
 * 2. requireOrgId - Ensures request has x-org-id header
 * 3. withTenantContext - Opens the RLS tenant scope (orgId + isSuperAdmin) for the request
 *
 * Use this for read-only routes that don't consume quota.
 *
 * @returns Array of middleware handlers ready to spread into route definition
 *
 * @example
 * ```typescript
 * router.get('/',
 *   ...createAuthenticatedWithOrgRoute(),
 *   async (req, res) => {
 *     // Handler implementation
 *   }
 * );
 * ```
 */
export declare function createAuthenticatedWithOrgRoute(): RequestHandler[];