import { BaseExecutionContext } from "@inkeep/agents-core";
import * as hono4 from "hono";
import { createAuth } from "@inkeep/agents-core/auth";

//#region src/middleware/manageAuth.d.ts

/**
 * Middleware to authenticate API requests using Bearer token authentication
 * Authentication priority:
 * 1. Bypass secret (INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET)
 * 2. Better-auth session token (from device authorization flow)
 * 3. Slack user JWT token (for Slack work app delegation)
 * 4. Internal service token
 *
 * NOTE: Database API keys are intentionally NOT accepted on manage endpoints,
 * EXCEPT for the legacy exception on GET /manage/tenants/:t/projects/:p/conversations/:id
 * (see isLegacyApiKeyAllowedRoute). API keys are otherwise restricted to the run domain only.
 */
declare const manageBearerAuth: () => hono4.MiddlewareHandler<{
  Variables: {
    executionContext: BaseExecutionContext;
    userId?: string;
    userEmail?: string;
    tenantId?: string;
    auth: ReturnType<typeof createAuth>;
  };
}, string, {}, Response>;
/**
 * Middleware that gates a route with manage-domain authentication.
 * Uses Bearer token → manage bearer auth (bypass secret, session, Slack JWT, internal service),
 * otherwise falls back to session auth.
 */
declare const manageBearerOrSessionAuth: () => hono4.MiddlewareHandler<any, string, {}, Response>;
//#endregion
export { manageBearerAuth, manageBearerOrSessionAuth };