import type { ISessionProvider } from '@mastra/core/auth';
import type { Mastra } from '@mastra/core/mastra';
import type { ApiRoute, MastraAuthConfig, MastraAuthProvider } from '@mastra/core/server';
import type { HonoRequest } from 'hono';
/**
 * Check if a route is a registered custom route that requires authentication.
 * Returns true only if the route is explicitly registered with requiresAuth: true.
 * Returns false if the route is not in the config or has requiresAuth: false.
 */
export declare const isProtectedCustomRoute: (path: string, method: string, customRouteAuthConfig?: Map<string, boolean>) => boolean;
/**
 * Find a matching custom API route for the given path and method.
 * Returns the matched route and any extracted path parameters.
 */
export declare const findMatchingCustomRoute: (path: string, method: string, apiRoutes?: ApiRoute[]) => {
    route: ApiRoute;
    params: Record<string, string>;
} | undefined;
/**
 * Check if request is from dev playground
 * @param getHeader - Function to get header value from request
 * @param customRouteAuthConfig - Map of custom route auth configurations
 */
export declare const isDevPlaygroundRequest: (path: string, method: string, getHeader: (name: string) => string | undefined, authConfig: MastraAuthConfig, customRouteAuthConfig?: Map<string, boolean>) => boolean;
export declare const isCustomRoutePublic: (path: string, method: string, customRouteAuthConfig?: Map<string, boolean>) => boolean;
export declare const isProtectedPath: (path: string, method: string, authConfig: MastraAuthConfig, customRouteAuthConfig?: Map<string, boolean>) => boolean;
export declare const canAccessPublicly: (path: string, method: string, authConfig: MastraAuthConfig) => boolean;
export declare const pathMatchesPattern: (path: string, pattern: string) => boolean;
export declare const pathMatchesRule: (path: string, rulePath: string | RegExp | string[] | undefined) => boolean;
export declare const matchesOrIncludes: (values: string | string[], value: string) => boolean;
export interface AuthMiddlewareContext {
    path: string;
    method: string;
    getHeader: (name: string) => string | undefined;
    mastra: Mastra;
    authConfig: MastraAuthConfig;
    customRouteAuthConfig?: Map<string, boolean>;
    requestContext: {
        get: (key: string) => unknown;
        set: (key: string, value: unknown) => void;
    };
    rawRequest: unknown;
    token: string | null;
    buildAuthorizeContext: () => unknown;
}
export type AuthResult = {
    action: 'next';
    headers?: Record<string, string>;
} | {
    action: 'error';
    status: number;
    body: Record<string, unknown>;
    headers?: Record<string, string>;
};
export interface GetAuthenticatedUserOptions {
    mastra: Mastra;
    token: string;
    request: Request | HonoRequest;
}
export declare const getAuthenticatedUser: <TUser = unknown>({ mastra, token, request, }: GetAuthenticatedUserOptions) => Promise<TUser | null>;
/**
 * Check if an auth config object supports transparent session refresh.
 * Returns true if the auth provider implements the necessary ISessionProvider methods.
 */
export declare function supportsSessionRefresh(authConfig: MastraAuthConfig | MastraAuthProvider): authConfig is (MastraAuthConfig | MastraAuthProvider) & Pick<ISessionProvider, 'refreshSession' | 'getSessionIdFromRequest' | 'getSessionHeaders'>;
/**
 * Single auth middleware: authenticate → authorize.
 * Skip checks (dev playground, unprotected path, public path) are evaluated once.
 */
export declare const coreAuthMiddleware: (ctx: AuthMiddlewareContext) => Promise<AuthResult>;
export declare const checkRules: (rules: MastraAuthConfig["rules"], path: string, method: string, user: unknown) => Promise<boolean>;
//# sourceMappingURL=helpers.d.ts.map