/**
 * API Key Handler
 *
 * Authenticates requests that carry an API key header, resolving the key to its
 * owning user. Runs before the JWT auth handler in the middleware pipeline.
 *
 * **Single auth mechanism per request:**
 * When the configured API key header is present it is the ONLY credential considered.
 * A valid key authenticates as the owning user; on a protected route an invalid/expired/revoked
 * key (or one used from a disallowed IP) results in access denied — the request never falls back
 * to cookie/bearer authentication.
 *
 * **Optional identification on public routes:**
 * On a `@Public()` route the key is best-effort (mirrors the JWT optional-auth path): a valid key
 * still attaches the owning user so downstream handlers know who is calling, but a missing/invalid
 * key is tolerated and the request proceeds unauthenticated rather than failing.
 *
 * **Platform-Agnostic:**
 * Operates purely on the NAuthRequest interface. Route opt-in enforcement (which endpoints
 * accept API keys) is handled separately by the adapter (guard/`requireAuth` helper).
 */
import { NAuthConfig, NAuthLogger, AuthService } from '../index';
import { ApiKeyService } from '../services/api-key.service';
import { NAuthRequest, NAuthResponse } from '../platform/interfaces';
/**
 * AuthHandler counterpart for API key authentication.
 */
export declare class ApiKeyHandler {
    private readonly apiKeyService;
    private readonly authService;
    private readonly config;
    private readonly logger?;
    constructor(apiKeyService: ApiKeyService, authService: AuthService, config: NAuthConfig, logger?: NAuthLogger | undefined);
    /**
     * Handle request - validate API key (if present) and attach user.
     *
     * @throws {NAuthException} On an invalid/expired key or disallowed IP (access denied).
     */
    handle(req: NAuthRequest, _res: NAuthResponse, next: () => Promise<void> | void): Promise<void>;
    /**
     * Resolve the caller IP for IP-allowlist enforcement and usage tracking.
     * Prefers the client info already captured on context, falling back to req.ip.
     */
    private resolveCallerIp;
    /**
     * Update CLIENT_INFO with the resolved user id (internal) and sub (UUID).
     */
    private updateClientInfoUser;
}
//# sourceMappingURL=api-key.handler.d.ts.map