import type { Request, RequestHandler } from 'express';
import type { AccessConfig, CollectionConfig } from './types.js';
import type { PqResult } from './pq.js';
export interface AccessRequest extends Request {
    skyemetaAccess?: {
        wallet: string;
        collection: CollectionConfig;
        tierKey: string;
        /**
         * Post-quantum companion verdict for the upstream attestation that admitted THIS request:
         * `verified`, `refuted`, `absent`, or `unverifiable` with a reason. Undefined when the
         * request was served from cache or in local mode.
         */
        pq?: PqResult;
    };
}
export declare class Access {
    private readonly insumerApiKey;
    private readonly collections;
    private readonly nonceStore;
    private readonly cacheTtlMs;
    private readonly cache;
    private readonly disabled;
    private readonly siweDomain;
    private readonly localMode;
    private readonly attestClient;
    constructor(config: AccessConfig);
    requireValidPassOrApiKey(apiKeyHandler: RequestHandler): RequestHandler;
    requireValidPassOrApiKey(tierKey: string, apiKeyHandler: RequestHandler): RequestHandler;
    requireValidPass(tierKey?: string): RequestHandler;
    /**
     * Post-quantum companion verdict from the most recent upstream `/v1/attest` call made by this
     * instance, whichever request triggered it. Instance-wide and therefore racy under load; for
     * the verdict that belongs to a specific request read `req.skyemetaAccess.pq` (undefined when
     * the request was served from cache or in local mode).
     */
    get lastPq(): PqResult | undefined;
    hasValidPass(tierKey: string, walletAddress: string): Promise<boolean>;
    verifyWalletSignIn(authorizationHeader: string | undefined): Promise<string>;
    private handleWalletAuth;
    private checkPassWithCache;
    private sendError;
    private normalizeMiddlewareArgs;
    private defaultTierKey;
    private assertTierKey;
    private emitStartupWarnings;
}
//# sourceMappingURL=access.d.ts.map