import { AuthenticatedUser } from "./types";
export interface AuthContext {
    user: AuthenticatedUser;
    apiKey?: string;
}
/**
 * Set the authenticated user for stdio transport mode.
 * Called once at startup after validating the ARCAGENT_API_KEY.
 */
export declare function setStdioAuthUser(user: AuthenticatedUser, apiKey?: string): void;
/**
 * Run a callback within an authenticated context.
 * Used by the HTTP transport handler after validating the API key.
 */
export declare function runWithAuth<T>(user: AuthenticatedUser, apiKeyOrFn: string | (() => T), maybeFn?: () => T): T;
/**
 * Get the authenticated user from the current context.
 * Checks AsyncLocalStorage first (HTTP), then stdio fallback.
 */
export declare function getAuthUser(): AuthenticatedUser | undefined;
/**
 * Get the API key from auth context (HTTP) or stdio fallback.
 */
export declare function getAuthApiKey(): string | undefined;
/**
 * Get the authenticated user or throw if not available.
 * For use in tools that require authentication.
 */
export declare function requireAuthUser(): AuthenticatedUser;
/**
 * Get the authenticated API key or throw if not available.
 */
export declare function requireAuthApiKey(): string;
/**
 * SECURITY (H4): Check that the authenticated user has the required scope.
 * Throws if the user's API key doesn't include the specified scope.
 */
export declare function requireScope(scope: string): void;
//# sourceMappingURL=context.d.ts.map