/**
 * Authentication middleware for the Weft HTTP server.
 *
 * Supports three authentication methods, all optional and configurable:
 * - **API keys**: validated via `Authorization: Bearer <key>` or `X-API-Key` header
 * - **JWT**: HMAC or RSA/ECDSA signature verification with claims validation
 * - **mTLS**: mutual TLS at the transport layer (configured via Bun.serve tls options)
 *
 * @module server/authentication
 */
import { type AuthConfig, type Authenticator } from './types.ts';
export { defaultAuthAuditSink, emitAuthAuditEvent, type AuthAuditContext, type AuthAuditEvent, type AuthAuditSink, } from './audit.ts';
export { importJWTKey, signJWT, verifyJWT } from './crypto.ts';
export { createRateLimiter, validateRateLimitConfig, type RateLimitConfig, type RateLimitDecision, type RateLimiter, } from './rate-limiter.ts';
export { isSensitiveHeader, redactCredential, redactHeaders } from './redaction.ts';
export { createRotatingApiKeyStore, type ApiKeyRegistration, type RotatingApiKeyStore, } from './rotating-api-key-store.ts';
export { DEFAULT_CLOCK_TOLERANCE, DEFAULT_PUBLIC_PATHS, type AuthConfig, type AuthContext, type Authenticator, type AuthMethod, type AuthResult, type JWTAlgorithm, type JWTConfig, type JWTPayload, type MTLSConfig, } from './types.ts';
/**
 * Validate an `AuthConfig` eagerly, throwing on invalid combinations.
 * Called synchronously in `serve()` so misconfigurations fail fast.
 *
 * @example
 * ```ts
 * import { validateAuthConfig } from '@lostgradient/weft';
 *
 * // Throws if config is invalid (e.g. missing secret for HS256)
 * validateAuthConfig({
 *   apiKeys: ['secret-key-1'],
 * });
 * console.log('Config is valid');
 * ```
 */
export declare function validateAuthConfig(config: AuthConfig): void;
/**
 * Create an authenticator function from an auth configuration.
 *
 * The returned function checks each configured method in order:
 * 1. Public path bypass
 * 2. API key (constant-time digest scan)
 * 3. JWT (signature + claims verification)
 * 4. mTLS (transport-level — any request that reaches the handler is authenticated)
 *
 * @example
 * ```ts
 * import { createAuthenticator } from '@lostgradient/weft';
 *
 * const authenticate = await createAuthenticator({
 *   apiKeys: ['my-secret-key'],
 * });
 * const request = new Request('http://localhost/v1/workflows', {
 *   headers: { 'X-API-Key': 'my-secret-key' },
 * });
 * const result = await authenticate(request);
 * console.log(result.authenticated); // true
 * ```
 */
export declare function createAuthenticator(config: AuthConfig): Promise<Authenticator>;
/**
 * Build Bun.serve-compatible TLS options from an mTLS configuration.
 * Returns `undefined` when no mTLS is configured.
 */
export declare function buildTLSOptions(config: AuthConfig | undefined): {
    cert: string;
    key: string;
    ca: string | string[];
    requestCert: boolean;
    rejectUnauthorized: boolean;
} | undefined;