/**
 * AAuth admission middleware.
 *
 * Runs after {@link aauthVerify} and {@link attributionContext}: looks up
 * the active `agent_grant` for the verified AAuth identity and stamps
 * the resolved decision onto the request as `req.aauthAdmission` plus
 * `req.authenticatedUserId` when an active grant matches. Per the
 * Stronger AAuth Admission plan, this is what makes verified AAuth a
 * third remote auth path alongside Bearer / OAuth / X-Connection-Id.
 *
 * The middleware is non-blocking: callers without an AAuth signature,
 * with an unverified signature, or whose identity does not match an
 * active grant flow through unchanged. Whether to reject afterwards is
 * the responsibility of route gates (e.g. the `/mcp` `hasAuth` check
 * and the direct-HTTP write-route auth middleware in
 * [src/actions.ts](../actions.ts)).
 */
import type { Request, RequestHandler } from "express";
import type { AAuthAdmissionContext } from "../services/protected_entity_types.js";
/**
 * Express middleware. Stamps `req.aauthAdmission` and (when admitted)
 * `req.authenticatedUserId`, then nests a {@link runWithRequestContext}
 * scope so deep services (`assertCanWriteProtected`,
 * `enforceAgentCapability`) read the same admission via
 * `getCurrentAAuthAdmission()`.
 */
export declare function aauthAdmission(): RequestHandler;
/** Helper for handlers that want the stamped admission without a context dive. */
export declare function getAAuthAdmissionFromRequest(req: Request): AAuthAdmissionContext | null;
//# sourceMappingURL=aauth_admission.d.ts.map