/**
 * The managed `identity.ts` declaration primitive.
 *
 * A project's root `identity.ts` exports a named `identity` created with
 * `defineIdentity(...)`. The compiler discovers it, generates the custom-auth
 * handler, and wires thread ownership for authenticated callers.
 *
 * This module is pure authoring-time config construction plus eager validation —
 * it has no runtime dependency (the `auth.*` helpers return plain data).
 */
import { type IdentityOptions } from "./options.js";
import { type SupabaseProviderOptions } from "./supabase.js";
import type { IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, ValidatedTokenProvider } from "./types.js";
export { normalizeGroups, userClaimName } from "./claims.js";
export { normalizeIdentity } from "./options.js";
export type { IdentityAuth, IdentityOptions } from "./options.js";
export type { ClaimMapping, CredentialScope, HttpIngress, IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
/**
 * Declare the identity contract for the deployment.
 *
 * Managed identity always gives each caller private threads and downstream
 * credentials. Authentication must be declared explicitly:
 *
 * ```ts
 * export const identity = defineIdentity({
 *   auth: auth.langsmithApiKey(),
 * });
 * ```
 *
 * Otherwise describe how callers authenticate:
 *
 * ```ts
 * export const identity = defineIdentity({
 *   auth: auth.supabase({ projectRef: "abcdefgh" }),
 * });
 * ```
 */
export declare function defineIdentity(options: IdentityOptions): IdentityDefinition;
/**
 * Authentication modes and validated-token providers. Every helper returns
 * plain authoring-time configuration; the managed runtime performs validation.
 */
export declare const auth: {
    /** Authenticate workspace/service callers with a LangSmith `x-api-key`. */
    langsmithApiKey(): LangSmithApiKeyIngress;
    /** @see {@link supabaseProvider} */
    supabase(options: SupabaseProviderOptions): ValidatedTokenProvider;
};
/**
 * Eagerly reject illegal identity configs at authoring time so misconfig never
 * reaches the compiler or runtime.
 */
export declare function validateIdentity(config: IdentityConfig): void;
//# sourceMappingURL=index.d.ts.map