import { type ApiKeyClaims } from "@hasna/contracts/auth";
import type { TypedQueryClient } from "../../generated/storage-kit/query.js";
import type { RoutePolicy, TenantRole, TokenKind } from "./route-policy.js";
export interface TenantAuthContext {
    tenantId: string;
    principalId: string;
    requestId: string;
    kid: string;
    agent: string | null;
    scopes: string[];
    roles: TenantRole[];
    tokenKind: TokenKind;
    claims: ApiKeyClaims;
}
export type TenantAuthDecision = {
    ok: true;
    status: 200;
    principal: TenantAuthContext;
} | {
    ok: false;
    status: 401 | 403 | 503;
    reason: string;
    message: string;
    requestId: string;
};
export declare class TenantApiAuthenticator {
    private readonly client;
    private readonly signingSecret;
    private readonly now;
    constructor(client: TypedQueryClient, signingSecret: string | Buffer, now?: () => number);
    authenticate(headers: Headers, context: {
        method: string;
        path: string;
        policy: RoutePolicy;
    }): Promise<TenantAuthDecision>;
    private deny;
    private audit;
}