import type { LogContext } from '@rocicorp/logger';
import type { JWTPayload } from 'jose';
import { type ErrorBody } from '../../../zero-protocol/src/error.ts';
/** @deprecated JWT auth is deprecated */
export type JWTAuth = {
    readonly type: 'jwt';
    readonly raw: string;
    readonly decoded: JWTPayload;
};
export type OpaqueAuth = {
    readonly type: 'opaque';
    readonly raw: string;
};
export type Auth = OpaqueAuth | JWTAuth;
export interface AuthSession {
    /** Update the auth session with a new userID and token from the client */
    update(userID: string, wireAuth: string | undefined): Promise<AuthUpdateResult>;
    /** The revision of the auth state */
    get revision(): number;
    /** The auth state for the session */
    get auth(): Auth | undefined;
    /** Clear the auth session, removing any stored auth and allowing a new userID to be bound on the next update. */
    clear(): void;
}
export type AuthUpdateResult = {
    readonly ok: true;
} | {
    readonly ok: false;
    readonly error: ErrorBody;
};
export type ValidateLegacyJWT = (token: string, ctx: {
    readonly userID: string;
}) => Promise<JWTAuth>;
export declare class AuthSessionImpl implements AuthSession {
    #private;
    readonly id: string;
    constructor(lc: LogContext, clientGroupID: string, validateLegacyJWT: ValidateLegacyJWT | undefined);
    get auth(): Auth | undefined;
    get revision(): number;
    clear(): void;
    update(userID: string, wireAuth: string | undefined): Promise<AuthUpdateResult>;
}
/** @deprecated used only in old JWT validation/rotation auth */
export declare function pickToken(lc: LogContext, previousToken: Auth | undefined, newToken: Auth | undefined | null): Auth | undefined;
//# sourceMappingURL=auth.d.ts.map