/**
 * Authentication context representing the authenticated caller
 *
 * Authenticated caller context.
 * - Solid Token: user provides Bearer or DPoP token
 * - CSS client credentials wrapper: third-party provides client_id/client_secret,
 *   API Server exchanges them for a Solid token
 * - Node Token: edge node provides node API key
 */
export interface SolidAuthContext {
    type: 'solid';
    webId: string;
    accountId?: string;
    clientId?: string;
    clientSecret?: string;
    displayName?: string;
    accessToken?: string;
    tokenType?: 'Bearer' | 'DPoP';
    dpopProof?: string;
    /** Whether this was authenticated via the sk-* CSS client credentials wrapper */
    viaApiKey?: boolean;
    /** Whether this principal was authenticated by an AI gateway access key. */
    viaGatewayApiKey?: boolean;
    /** Whether the gateway runtime may resolve this principal's allowlisted Pod-backed AI data. */
    gatewayRuntimeAccess?: boolean;
    /** Stable identifier of the AI gateway key used for this request. */
    gatewayKeyId?: string;
    /** Non-secret fingerprint used by gateway acceptance provenance. */
    gatewayKeyFingerprint?: string;
    /** Whether this principal came from a stateless internal runtime invocation token. */
    internalInvocation?: boolean;
    /** Explicit API scopes bound to constrained principals such as invocation tokens. */
    scopes?: string[];
}
export interface NodeAuthContext {
    type: 'node';
    nodeId: string;
    accountId?: string;
}
export interface ServiceAuthContext {
    type: 'service';
    serviceType: 'local' | 'business' | 'cloud' | 'compute';
    serviceId: string;
    scopes: string[];
}
export type AuthContext = SolidAuthContext | NodeAuthContext | ServiceAuthContext;
export declare function isSolidAuth(ctx: AuthContext): ctx is SolidAuthContext;
export declare function hasSolidClientCredentialsAuthority(ctx: AuthContext | undefined): ctx is SolidAuthContext & {
    clientId: string;
    clientSecret: string;
    viaApiKey: true;
};
export declare function isNodeAuth(ctx: AuthContext): ctx is NodeAuthContext;
/**
 * Get webId from auth context
 */
export declare function getWebId(ctx: AuthContext): string | undefined;
/**
 * Get display name from auth context
 */
export declare function getDisplayName(ctx: AuthContext): string | undefined;
/**
 * Get accountId from auth context (if available)
 */
export declare function getAccountId(ctx: AuthContext): string | undefined;
export declare function getNodeId(ctx: AuthContext): string | undefined;
export declare function isServiceAuth(ctx: AuthContext): ctx is ServiceAuthContext;
/**
 * Check if a service auth context has the required scope.
 */
export declare function hasScope(ctx: AuthContext, scope: string): boolean;