/**
 * Authentication orchestrator.
 *
 * Verifies an inbound credential, extracts the delegation it carries,
 * and binds a `BoundClientSessionView` for outbound kernel calls. Delegates
 * the real work to `verify`, `compose` + `sign` (inside `kernel-client`),
 * and returns a generic `Authenticated` result plus the bound view.
 */
import type { FnMap } from '@astrale-os/kernel-client';
import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
import type { Authenticated, CredentialInput } from '@astrale-os/kernel-core';
import type { RemoteIdentityConfig } from './identity.js';
export type AuthenticateResult = {
    authenticated: Authenticated;
    kernel: BoundClientSessionView<FnMap> | null;
};
/**
 * Verifies an inbound credential and binds a call-back kernel view. The `sub`
 * claim on the outbound credential is the function's own identity, taken from
 * `config.subject` (the function node's path), so the kernel matches an
 * existing function identity instead of provisioning a generic one.
 */
export declare function authenticateRequest(credential: CredentialInput, config: RemoteIdentityConfig): Promise<AuthenticateResult>;
//# sourceMappingURL=authenticate.d.ts.map