import { ApiKeyStore, type ApiKeyVerifier, type AuthAuditEvent } from "@hasna/contracts/auth";
/** Resolve the signing secret from the app-specific then shared env var. */
export declare function resolveSigningSecret(env?: NodeJS.ProcessEnv): string | undefined;
/** The api-keys store (cloud only), for revocation checks + schema bootstrap. */
export declare function getApiKeyStore(): ApiKeyStore | null;
/**
 * Build (once) the request verifier. Returns null when no signing secret is
 * configured — the caller must then refuse /v1 (fail-closed).
 */
export declare function getVerifier(auditLog?: (e: AuthAuditEvent) => void): ApiKeyVerifier | null;
/** Ensure the api_keys table exists (cloud only). Best-effort; safe to call repeatedly. */
export declare function ensureAuthSchema(): Promise<void>;
/** Test hook. */
export declare function resetAuth(): void;
//# sourceMappingURL=auth.d.ts.map