import type { AuthOptions, AuthRuntime } from './types.js';
export * from './providers.js';
export * from './stores.js';
export type * from './types.js';
/**
 * Create an isolated auth runtime: its direct Request handler, the route
 * handlers that mount it, and the session helpers.
 *
 * The endpoints are served by an `app/<basePath>/[...path]/route.ts` that
 * re-exports `auth.handlers` — the same file on every host, `ruvyxa dev`/`start`
 * and every deployed build alike. `auth.handle(request)` is the same dispatch
 * for an application that mounts the endpoints itself.
 *
 * A production process refuses development stores here, at construction,
 * rather than in a build hook: the process that would serve sessions out of
 * its own memory is the one that must not start.
 */
export declare function createAuth(options: AuthOptions): AuthRuntime;
/**
 * Read the client IP from `x-forwarded-for`, taking the rightmost entry: each
 * proxy appends the peer address it actually saw, so the rightmost value is
 * the one written by the nearest (trusted) proxy, while the leftmost entries
 * are client-supplied and spoofable. Use as `clientIp: forwardedClientIp`
 * only when a trusted proxy or platform edge sits in front of the app.
 */
export declare function forwardedClientIp(request: Request): string | null;
export declare class AuthError extends Error {
    readonly code: 'RUV3100' | 'RUV3101' | 'RUV3102' | 'RUV3103' | 'RUV3104' | 'RUV3105';
    readonly status: number;
    readonly retryAfterSeconds?: number | undefined;
    constructor(code: 'RUV3100' | 'RUV3101' | 'RUV3102' | 'RUV3103' | 'RUV3104' | 'RUV3105', message: string, status: number, retryAfterSeconds?: number | undefined, options?: ErrorOptions);
}
//# sourceMappingURL=index.d.ts.map