export declare const LOCAL_DEV_USER_ID = "00000000-0000-0000-0000-000000000000";
/**
 * Dedicated public-user id for the `NEOTOMA_SANDBOX_MODE` deployment at
 * `sandbox.neotoma.io`. Kept distinct from `LOCAL_DEV_USER_ID` so any future
 * data migration can tell sandbox-written entities apart from local-dev ones
 * and so the body-level `user_id` override (granted to LOCAL_DEV_USER_ID in
 * `getAuthenticatedUserId`) does NOT leak to public sandbox writers.
 */
export declare const SANDBOX_PUBLIC_USER_ID = "11111111-1111-1111-1111-111111111111";
export interface LocalAuthUser {
    id: string;
    email: string;
    created_at: string;
    updated_at: string;
    last_login_at?: string | null;
}
export declare function getLocalAuthUserByEmail(email: string): LocalAuthUser | null;
export declare function getLocalAuthUserById(userId: string): LocalAuthUser | null;
export declare function countLocalAuthUsers(): number;
export declare function createLocalAuthUser(email: string, password: string): LocalAuthUser;
export declare function authenticateLocalUser(email: string, password: string, allowBootstrap: boolean): LocalAuthUser;
export declare function ensureLocalDevUser(): LocalAuthUser;
/**
 * Ensure the shared sandbox public user exists, used by sandbox-mode bearer
 * bypass for unauthenticated writes on `sandbox.neotoma.io`. Idempotent; safe
 * to call on every request.
 */
export declare function ensureSandboxPublicUser(): LocalAuthUser;
/**
 * Ensure a deterministic per-thumbprint sandbox user exists for AAuth-verified
 * requests on `sandbox.neotoma.io`. The same thumbprint always resolves to the
 * same user_id (via sha256("aauth:" + thumbprint) mapped to UUID shape), so
 * sandbox writes signed by a given AAuth key are partitioned away from the
 * public sandbox user and from other agents' keys.
 *
 * The synthetic user is functionally inert for login: the password hash is
 * derived from the thumbprint itself (not user-supplied) and the
 * `@sandbox.neotoma.local` email is not exposed to `authenticateLocalUser`
 * via any external surface. Idempotent; safe to call on every request.
 */
export declare function ensureSandboxAauthUser(thumbprint: string): LocalAuthUser;
//# sourceMappingURL=local_auth.d.ts.map