import { type DiscoveredAwsProfile } from "../discover.js";
import type { SchemaSnapshot } from "../types.js";
import type { ApiAuth } from "./session.js";
/**
 * Work out how to be a logged-in user without being told.
 *
 * The connection string genuinely cannot be inferred — it is a secret that
 * lives wherever the developer put it. The *auth provider* is not like that.
 * It is a dependency in `package.json` and a variable in the `.env` file
 * beside it, both of which are on disk and both of which name the stack
 * unambiguously. Asking a developer to write down a fact their repository
 * already states is how a default becomes a decision.
 *
 * Two rules keep this from becoming a guess:
 *
 *   - Nothing is ever invented. A strategy is chosen only when both the
 *     provider *and* the material it needs are present; a provider found
 *     without its secret is a refusal that names the variable, not a fallback
 *     to something weaker.
 *   - A provider Crossline structurally cannot impersonate is named as such.
 *     Clerk, Auth0, Cognito and Firebase Auth all sign with keys that never
 *     leave the provider, so nothing can be minted for them — what can be done
 *     is to ask each one for a session, which is what the four provider
 *     strategies do, and where that is unavailable (a Clerk production
 *     instance, a missing key) saying so plainly is worth more than a run that
 *     quietly checks only the signed-out half.
 */
export type Detection = {
    ok: true;
    auth: ApiAuth;
    how: string;
} | {
    ok: false;
    reason: string;
};
export interface DetectContext {
    /** The project directory. Null when the caller has none, e.g. a bare library use. */
    cwd: string | null;
    /** The schema, which is where a database-session table is found. */
    snapshot?: SchemaSnapshot;
    /** Ambient environment. Defaults to `process.env`. */
    env?: NodeJS.ProcessEnv;
    /**
     * AWS's shared config, for the Cognito strategy. Defaults to reading the real
     * `~/.aws/*` files; passed explicitly by tests, which must never depend on
     * whether the machine running them happens to have AWS credentials on it.
     */
    awsProfile?: DiscoveredAwsProfile;
}
export declare function detectApiAuth(ctx: DetectContext): Detection;
interface EnvValue {
    value: string;
    /** Where it came from, for the report: `$NAME` or the file it was read out of. */
    from: string;
}
/**
 * Read the project's `.env` files — the same walk that finds the database.
 *
 * The directory the command was run in first, so a single-package project
 * behaves exactly as it always has, then out to the repository root and back
 * down into it. That last part is the whole change: `crossline` gets typed at a
 * monorepo root, `CLERK_SECRET_KEY` lives in `apps/web/.env.local`, and reading
 * only `cwd` meant the run reported that no auth provider was recognised — true
 * of the one file it opened, false of the repository in front of it.
 *
 * The first definition wins, matching the precedence every framework in this
 * list already uses, and `from` names the file relative to where the reader is
 * standing so the report can say `apps/web/.env.local` rather than `.env.local`
 * for a file two levels away.
 */
export declare function readEnvFiles(cwd: string): Map<string, EnvValue>;
/**
 * The dotenv parser, which now lives beside the walk that uses it.
 *
 * There used to be two of these — one here for identity, one in `discover.ts`
 * for the connection string — reading the same four files off the same disk
 * with quietly different rules about trailing comments and repeated keys. One
 * file, one answer: re-exported rather than reimplemented so the name stays
 * where its callers look for it.
 */
export { readEnvFile as parseEnvFile } from "../discover.js";