/**
 * AAuth admission service.
 *
 * Maps a verified AAuth identity to a Neotoma `agent_grant` and returns
 * an admission decision that downstream middleware threads onto the
 * request as `req.aauthAdmission` and `req.authenticatedUserId`.
 *
 * High-level flow:
 *
 *   verified AAuth identity (sub / iss / thumbprint)
 *     → agent_grants.findActiveGrantByIdentity
 *     → admitted: true + { user_id, grant_id, capabilities }
 *
 * Unknown identities stay attribution-only — the caller's request is
 * NOT rejected by this service; it just doesn't gain user resolution.
 * Whether to reject afterwards is the responsibility of route gates.
 *
 * The admission service also opportunistically asks the grants service
 * to record a `last_used_at` observation (debounced once per UTC day
 * per grant) so the Inspector can surface "active in the last X days"
 * without spending an observation per request.
 */
import type { AAuthRequestContext } from "../crypto/agent_identity.js";
import type { AAuthAdmissionContext, AAuthAdmissionReason } from "./protected_entity_types.js";
import { type AgentGrant } from "./agent_grants.js";
export type { AAuthAdmissionContext, AAuthAdmissionReason };
/**
 * Result returned by {@link admitFromAAuthContext}. Always non-null so
 * callers can stamp it on the request without branching.
 */
export interface AdmissionResult extends AAuthAdmissionContext {
    /** When admitted, the matched grant entity (full shape, useful for diagnostics). */
    grant?: AgentGrant;
}
/**
 * Resolve a verified AAuth identity (or null) to an admission decision.
 *
 * - `null` / not-verified input → `{ admitted: false, reason: "not_signed" }`.
 * - Identity present but no matching active grant →
 *   `{ admitted: false, reason: "no_match" | "grant_revoked" | ... }`.
 * - Match found → `{ admitted: true, user_id, grant_id, capabilities, ... }`
 *   and a debounced `last_used_at` observation is fired off.
 *
 * The function never throws on lookup failure: any internal error is
 * logged and returned as `not_signed` / `no_match` so the request keeps
 * flowing through attribution-only paths.
 */
export declare function admitFromAAuthContext(ctx: AAuthRequestContext | null): Promise<AdmissionResult>;
//# sourceMappingURL=aauth_admission.d.ts.map