import type { HandshakeRequest } from "./connection.ts";
/** What the authenticator grants a peer once it passes the gate. */
export interface AuthGrant {
    /** The authenticated principal (ADR 0028 identity). */
    readonly identity: string;
    /** Optional scope the identity is confined to (e.g. a plan/network). */
    readonly scope?: string;
    /** The capability credential the peer presented, if any. */
    readonly capability?: string;
}
/** Application close code for a rejected identity token. */
export declare const AUTH_UNAUTHORIZED = 4401;
/** Application close code for a missing/rejected capability credential. */
export declare const AUTH_FORBIDDEN = 4403;
export type AuthResult = {
    readonly ok: true;
    readonly grant: AuthGrant;
} | {
    readonly ok: false;
    readonly code: number;
    readonly reason: string;
};
/** Verifies a handshake and either grants or rejects the connection. */
export type Authenticator = (req: HandshakeRequest) => AuthResult | Promise<AuthResult>;
export interface SharedSecretAuthOptions {
    /** The shared identity-token secret every valid peer presents. */
    readonly secret: string;
    /** Require a capability credential too (default true). */
    readonly requireCredential?: boolean;
    /** Extra check on the credential; return false to reject. Default accept-any. */
    readonly verifyCredential?: (credential: string, identity: string) => boolean;
    /** Derive the identity from the handshake. Default: the connection's remote address (`req.remote`), or `anonymous`. */
    readonly identityFor?: (req: HandshakeRequest) => string;
}
/**
 * The default authenticator: a shared-secret identity token gate plus a required
 * capability credential. Mirrors nano-workforce's blackboard-hook `?token=…`
 * pattern; swap in a real ADR 0028 verifier by passing your own
 * {@link Authenticator} to the hub.
 */
export declare function sharedSecretAuthenticator(options: SharedSecretAuthOptions): Authenticator;