import type { UserAuthManager } from './user-auth.js';
export declare const OPERATOR_SESSION_COOKIE_NAME = "goodvibes_session";
export type AuthenticatedOperatorRequest = {
    readonly kind: 'shared-token';
    readonly token: string;
} | {
    readonly kind: 'pairing-token';
    readonly token: string;
    /** The per-pairing token's id (for `pairing:<id>` principal derivation). */
    readonly tokenId: string;
    /** The user-visible device name for this token. */
    readonly name: string;
} | {
    readonly kind: 'session';
    readonly token: string;
    readonly username: string;
    readonly roles: readonly string[];
};
/**
 * The synchronous per-pairing token authenticator the operator-auth path
 * consults BEFORE the legacy shared token. A revoked token misses here, so
 * revocation is honored on the very next request. Absent ⇒ no per-pairing
 * tokens are configured (only the shared token / user sessions authenticate).
 */
export interface PairingTokenAuthenticator {
    authenticate(token: string): {
        readonly id: string;
        readonly name: string;
    } | null;
    /** Whether the legacy single shared token has been revoked. */
    isLegacyRevoked(): boolean;
}
interface SessionCookieOptions {
    readonly req: Request;
    readonly expiresAt: number;
    readonly trustProxy?: boolean | undefined;
}
export declare function extractOperatorAuthToken(req: Request): string;
export declare function authenticateOperatorToken(token: string, context: {
    readonly sharedToken?: string | null | undefined;
    readonly userAuth: Pick<UserAuthManager, 'validateSession' | 'getUser'>;
    readonly pairingTokens?: PairingTokenAuthenticator | undefined;
}): AuthenticatedOperatorRequest | null;
export declare function authenticateOperatorRequest(req: Request, context: {
    readonly sharedToken?: string | null | undefined;
    readonly userAuth: Pick<UserAuthManager, 'validateSession' | 'getUser'>;
    readonly pairingTokens?: PairingTokenAuthenticator | undefined;
}): AuthenticatedOperatorRequest | null;
export declare function isOperatorAdmin(authenticated: AuthenticatedOperatorRequest | null): boolean;
export declare function buildOperatorSessionCookie(token: string, options: SessionCookieOptions): string;
export declare function buildExpiredOperatorSessionCookie(req: Request, trustProxy?: boolean): string;
export {};
//# sourceMappingURL=http-auth.d.ts.map