import type { Authenticatable, Guard, UserProvider } from './contracts.js';
import { type SessionStore } from './session-guard.js';
export interface AuthGuardConfig {
    driver: 'session';
    provider: string;
}
export interface AuthProviderConfig {
    driver: 'eloquent';
    model: unknown;
}
export interface AuthConfig {
    defaults: {
        guard: string;
    };
    guards: Record<string, AuthGuardConfig>;
    providers: Record<string, AuthProviderConfig>;
}
export declare class AuthManager {
    readonly config: AuthConfig;
    private readonly hashCheck;
    private readonly getSession;
    private readonly hashMake?;
    constructor(config: AuthConfig, hashCheck: (plain: string, hashed: string) => Promise<boolean>, getSession: () => SessionStore, hashMake?: ((plain: string) => Promise<string>) | undefined);
    /**
     * Build a fresh Guard each call. We deliberately do NOT cache guards on
     * the manager: AuthManager is a process-wide DI singleton, and a cached
     * SessionGuard would keep `_user` populated across requests — once any
     * request signs in, every subsequent request would see that user as
     * "still logged in" even with an empty session. A new instance per call
     * scopes `_user` to the local that the handler stores, which is the
     * request-natural lifetime.
     */
    guard(name?: string): Guard;
    attempt(credentials: Record<string, unknown>, remember?: boolean): Promise<boolean>;
    login(user: Authenticatable, remember?: boolean): Promise<void>;
    logout(): Promise<void>;
    user(): Promise<Authenticatable | null>;
    id(): Promise<string | null>;
    check(): Promise<boolean>;
    guest(): Promise<boolean>;
    loginUsingId(id: string | number, remember?: boolean): Promise<boolean>;
    /**
     * Resolve a UserProvider by name, independent of any guard. Used by
     * non-session drivers (e.g. `@rudderjs/sanctum`) that need user lookup
     * without instantiating a SessionGuard. With no `name`, falls back to
     * the default guard's configured provider.
     */
    createProvider(name?: string): UserProvider;
}
export declare function runWithAuth<T>(manager: AuthManager, fn: () => T): T;
/**
 * Run `fn` with the given user installed as the request's authenticated user.
 *
 * Used by `AuthMiddleware` in test mode to wire up `actingAs(user)` from
 * `@rudderjs/testing`. Outside test mode this is unused and incurs no cost.
 */
export declare function runWithTestUser<T>(user: Authenticatable, fn: () => T): T;
/**
 * Read the request-scoped test user, or `null` when none is installed.
 *
 * Checked by `SessionGuard.user()` BEFORE going to the session store so a
 * test acting as a synthetic user resolves without a DB round-trip.
 */
export declare function currentTestUser(): Authenticatable | null;
export declare function currentAuth(): AuthManager;
/**
 * Laravel-style helper — returns the current request's AuthManager.
 *
 * Mirrors Laravel's `auth()->user()`, `auth()->check()`, `auth()->guard('api')`.
 * Inside an HTTP handler (after AuthMiddleware has run) you can call:
 *
 *   await auth().user()
 *   await auth().check()
 *   await auth().guard('api').user()
 *
 * In non-HTTP contexts (CLI, queue, scheduler) you must still wrap the call
 * in `runWithAuth(manager, …)` yourself — there is no request pipeline to
 * populate the ALS context for you.
 */
export declare function auth(): AuthManager;
export declare class Auth {
    private static g;
    static guard(name: string): Guard;
    static attempt(credentials: Record<string, unknown>, remember?: boolean): Promise<boolean>;
    static login(user: Authenticatable, remember?: boolean): Promise<void>;
    static logout(): Promise<void>;
    static user(): Promise<Authenticatable | null>;
    static id(): Promise<string | null>;
    static check(): Promise<boolean>;
    static guest(): Promise<boolean>;
    static loginUsingId(id: string | number, remember?: boolean): Promise<boolean>;
}
//# sourceMappingURL=auth-manager.d.ts.map