/**
 * Lemma API v2 — authenticateV2 middleware (Lane D)
 *
 * Express factory. Usage:
 *
 *     import { authenticateV2 } from './cloud/identity';
 *     app.use(authenticateV2({ resolver, rateLimiter, policy }));
 *
 * On success it attaches `req.tenant = { id, plan, keyId }` and calls `next()`.
 * Missing or invalid keys → 401 `unauthenticated` (identical body for unknown
 * vs. revoked, so the endpoint never leaks key state). Rate limiting is applied
 * per tenant before the handler runs; exceeding it → 429 `rate_limited` with a
 * `Retry-After` header and an actionable body.
 */
import type { Request, RequestHandler } from 'express';
import { PlanPolicy, RATE_LIMIT_WINDOW_MS } from './PlanPolicy';
import type { RateLimiter } from './RateLimiter';
import type { Tenant, TenantResolver } from './TenantResolver';
declare global {
    namespace Express {
        interface Request {
            /** Set by authenticateV2 when a valid API key was presented. */
            tenant?: Tenant;
        }
    }
}
export interface AuthenticateV2Deps {
    resolver: Pick<TenantResolver, 'resolve'>;
    policy?: PlanPolicy;
    rateLimiter?: RateLimiter;
    /** Length of the per-tenant rate-limit window; defaults to 24h (UTC-day buckets). */
    rateLimitWindowMs?: number;
    /** Clock override for deterministic tests. */
    now?: () => number;
}
/** Convenience type for handlers that run behind authenticateV2. */
export type AuthenticatedRequest = Request & {
    tenant: Tenant;
};
/**
 * Build the auth middleware. `deps.rateLimiter` is optional: when provided, each
 * request consumes one slot from the tenant's window (limit from the tenant's
 * plan); when the window is exhausted the middleware answers 429 with Retry-After.
 */
export declare function authenticateV2(deps: AuthenticateV2Deps): RequestHandler;
export { RATE_LIMIT_WINDOW_MS };
export default authenticateV2;
//# sourceMappingURL=authenticateV2.d.ts.map