/**
 * Request admission gate: authentication then per-key rate limiting.
 *
 * Extracted from the server fetch dispatcher so the dispatch path stays small.
 * `gateRequest` runs the two short-circuiting steps a request must pass before
 * any handler sees it:
 *   1. **Authentication** — produces the auth context, a 401, or a public-path
 *      bypass. Auth-event auditing happens inside the authenticator itself.
 *   2. **Rate limiting** — throttles per principal-or-IP key, returning 429 with
 *      `Retry-After` once a key exceeds its window budget. Public-path requests
 *      and servers without a `rateLimit` are never throttled. Failed-auth
 *      requests are also checked against the IP-keyed limiter so that
 *      credential-stuffing floods are shed before returning the 401.
 *
 * @internal
 */
import type { AuthContext } from '../authentication.ts';
import type { ServerContext } from './context.ts';
/**
 * Outcome of {@link authenticateRequest}: the resolved auth context (absent for
 * public-path bypass and unauthenticated servers), a short-circuit `response`
 * (a 401 on rejection, else `null`), and whether the request hit a public path.
 */
export type AuthenticationOutcome = {
    authContext?: AuthContext;
    response: Response | null;
    /**
     * `true` when the request matched a configured public path and bypassed
     * authentication. The rate-limit step uses this to exempt health, metrics,
     * and discovery probes from per-key throttling.
     */
    publicBypass: boolean;
};
export declare function authenticateRequest(context: ServerContext, request: Request): Promise<AuthenticationOutcome>;
/**
 * Run the request gate: authenticate, then rate-limit. Returns a short-circuit
 * `response` (401 or 429) when either step rejects, otherwise `response: null`
 * with the resolved authentication outcome.
 *
 * Failed-auth requests are checked against the IP-keyed limiter before the 401
 * is returned so that credential-stuffing floods consume the rate-limit budget
 * and are eventually shed with a 429 instead of burning CPU indefinitely.
 *
 * `originalRequest` (when provided) is used solely for IP lookup in
 * `server.requestIP()`. Certain callers rewrite the request URL (e.g. to strip
 * an `/api` prefix) via `new Request(url, request)`, which loses Bun's internal
 * socket handle — so `requestIP` on the rewritten copy returns `null`. Passing
 * the pre-rewrite request here ensures IP-based rate limiting stays functional
 * on the `/api/…` prefix path.
 */
export declare function gateRequest(server: ReturnType<typeof Bun.serve>, context: ServerContext, request: Request, originalRequest?: Request): Promise<{
    response: Response | null;
    authentication: AuthenticationOutcome;
}>;