import type { Container } from '../../../../helpers/inversion/container';
import type { TClass } from '@venizia/ignis-helpers/common';
import { AbstractAuthRegistry } from '../../base';
import type { IAuthenticationStrategy } from '../common';
export declare class AuthenticationStrategyRegistry extends AbstractAuthRegistry<IAuthenticationStrategy> {
    static readonly SINGLETON_REAL_KEY = "authentication-strategy-registry";
    constructor();
    static getInstance(): AuthenticationStrategyRegistry;
    protected getBindingPrefix(): string;
    register(opts: {
        container: Container;
        strategies: {
            strategy: TClass<IAuthenticationStrategy>;
            name: string;
        }[];
    }): this;
    resolveStrategy(opts: {
        name: string;
    }): IAuthenticationStrategy;
    /**
     * The names on this list that no registered strategy answers to.
     *
     * An EMPTY list yields nothing - it is the framework's own encoding of
     * `authenticate: { skip: true }`, so treating it as a problem would flag every public route.
     *
     * Nothing is reported while the registry is empty. Route configs are built during
     * `registerControllers()`, after `preConfigure()` and `registerComponents()`, so a real
     * application has registered by then; an empty registry means this is running outside that
     * lifecycle - a unit test on a controller - where no name could resolve either way.
     */
    findUnregistered(opts: {
        names: string[];
    }): string[];
    /**
     * Refuses to continue past an unregistered name. For an APPLICATION's own startup check.
     *
     * The framework does NOT call this - it reports instead. A hard failure cannot be the default
     * here: a route listing several strategies in ANY mode tolerates one that does not resolve, and
     * `defineAuthController` hard-codes `'jwt'` on four of its routes, so an application that
     * registers its JWT strategy under a different name works today and would stop booting.
     */
    assertRegistered(opts: {
        names: string[];
        scope?: string;
    }): void;
    /**
     * Names an unregistered strategy at boot, at a level someone sees. Never throws.
     *
     * This is what replaces the guard the open `TAuthStrategy` gave up: `resolveStrategy` throws at
     * request time, the provider's ANY mode swallows it at DEBUG, and the route 401s with nothing to
     * explain why.
     */
    reportUnregistered(opts: {
        names: string[];
        scope?: string;
    }): void;
}
//# sourceMappingURL=strategy-registry.d.ts.map