import type { User } from '@spinajs/rbac';
/**
 * Adds application fields to every auth response that reports the session's active role:
 * login, 2FA verification, whoami, both `/auth/active-role` operations and impersonation.
 * The framework knows nothing about the fields themselves - an application registers a
 * provider with `@Injectable(SessionContextProvider)` and its fields ride along.
 *
 * `resolve` gets the role the response reports, so a value derived from it follows a role
 * switch without the client asking again.
 */
export declare abstract class SessionContextProvider {
    /**
     * JSON-schema properties of the fields `resolve` returns, merged into the published auth
     * response schemas. Static so the spec is built without instantiating the provider.
     */
    static Properties: Record<string, object>;
    abstract resolve(user: User, activeRole: string | undefined): Promise<Record<string, unknown>> | Record<string, unknown>;
}
/** Schema properties contributed by every registered provider. */
export declare function sessionContextProperties(): Record<string, object>;
/** Fields every registered provider adds for `user` acting as `activeRole`. */
export declare function resolveSessionContext(user: User, activeRole: string | undefined): Promise<Record<string, unknown>>;
//# sourceMappingURL=session-context.d.ts.map