/**
 * Trellis Server — Auth
 *
 * Produces an `AuthContext` from a request using one of:
 *   - Bearer JWT (signed with jwtSecret)
 *   - API key (compared against configured key)
 *   - Unauthenticated (public access)
 *
 * OAuth provider flows (Google, GitHub) are handled separately and ultimately
 * issue a JWT, so this module just needs to verify tokens.
 *
 * @module trellis/server
 */
export interface AuthContext {
    /** User entity ID (null = unauthenticated). */
    userId: string | null;
    /** Tenant ID (null = default tenant). */
    tenantId: string | null;
    /** Roles assigned to this user. */
    roles: string[];
    /** Raw JWT claims (if authenticated via JWT). */
    claims: Record<string, unknown>;
    /** Whether this request passed authentication. */
    authenticated: boolean;
}
export declare const ANONYMOUS: AuthContext;
/**
 * Sign a JWT payload with HS256.
 */
export declare function signJwt(payload: Record<string, unknown>, secret: string, expiresInSeconds?: number): Promise<string>;
/**
 * Verify and decode a JWT. Returns null if invalid or expired.
 */
export declare function verifyJwt(token: string, secret: string): Promise<Record<string, unknown> | null>;
export interface AuthConfig {
    /** Secret for JWT verification. Required for JWT auth. */
    jwtSecret?: string;
    /** Static API key. If set, `Authorization: Bearer <key>` is also accepted. */
    apiKey?: string;
    /** Allow unauthenticated (public) access. Default: true. */
    allowPublic?: boolean;
}
/**
 * Resolve an `AuthContext` from an HTTP request's Authorization header.
 */
export declare function resolveAuth(authHeader: string | null | undefined, config: AuthConfig): Promise<AuthContext>;
export interface OAuthProvider {
    name: string;
    clientId: string;
    clientSecret: string;
    authUrl: string;
    tokenUrl: string;
    userInfoUrl: string;
    scopes: string[];
}
export declare const GOOGLE_PROVIDER: Omit<OAuthProvider, 'clientId' | 'clientSecret'>;
export declare const GITHUB_PROVIDER: Omit<OAuthProvider, 'clientId' | 'clientSecret'>;
/**
 * Build an OAuth authorization redirect URL.
 */
export declare function buildOAuthUrl(provider: OAuthProvider, redirectUri: string, state: string): string;
/**
 * Exchange an OAuth code for an access token + user info.
 * Returns normalized user profile.
 */
export declare function exchangeOAuthCode(provider: OAuthProvider, code: string, redirectUri: string): Promise<{
    id: string;
    email: string;
    name: string;
    avatarUrl?: string;
}>;
//# sourceMappingURL=auth.d.ts.map