/**
 * @name RemoteAuth
 * @description Authentication primitives for remote MCP server access control.
 */
import type { IncomingHttpHeaders } from 'http';
/**
 * @name AuthResult
 * @description Result of a remote authentication attempt.
 */
export interface AuthResult {
    success: boolean;
    userId?: string;
    error?: string;
}
/**
 * @name ApiKeyAuthConfig
 * @description API-key authentication configuration mapping bearer tokens to user identifiers.
 */
export interface ApiKeyAuthConfig {
    type: 'api_key';
    keys: ReadonlyMap<string, string>;
}
/**
 * @name JwtAuthConfig
 * @description HMAC-SHA256 JWT authentication configuration.
 */
export interface JwtAuthConfig {
    type: 'jwt';
    secret: string;
    issuer: string;
}
/**
 * @name NoAuthConfig
 * @description Public bearerless MCP mode for agent-facing x402-first deployments.
 */
export interface NoAuthConfig {
    type: 'none';
}
/**
 * @name RemoteAuthConfig
 * @description Supported remote authentication strategies.
 */
export type RemoteAuthConfig = ApiKeyAuthConfig | JwtAuthConfig | NoAuthConfig;
/**
 * @name APIKeyAuth
 * @description Validates bearer tokens against a configured API-key map.
 */
export declare class APIKeyAuth {
    private readonly keys;
    constructor(keys: ReadonlyMap<string, string>);
    /**
     * @name validate
     * @description Checks whether an API key exists in the configured key map.
     */
    validate(apiKey: string): AuthResult;
}
/**
 * @name JWTAuth
 * @description Validates HMAC-SHA256 bearer JWTs with issuer and expiration checks.
 */
export declare class JWTAuth {
    private readonly secret;
    private readonly issuer;
    constructor(secret: string, issuer: string);
    /**
     * @name validate
     * @description Verifies JWT structure, signature, issuer, subject, and expiration.
     */
    validate(token: string): AuthResult;
}
/**
 * @name AuthManager
 * @description Validates remote MCP request headers through the configured authentication strategy.
 */
export declare class AuthManager {
    private readonly apiKeyAuth?;
    private readonly jwtAuth?;
    private readonly publicAccess;
    constructor(config: RemoteAuthConfig);
    /**
     * @name validateFromHeaders
     * @description Validates remote access through the configured authentication strategy.
     */
    validateFromHeaders(headers: IncomingHttpHeaders): AuthResult;
}
//# sourceMappingURL=index.d.ts.map