import type { RateLimiter } from './rate-limit.js';
/**
 * The one check every reader of `jwt.secret` runs: `assertJwtConfigValid` at
 * wiring time, and `sharedLimiter` for a hand-built `AuthDeps` that never
 * passed it. The value itself is never echoed.
 */
export declare function assertJwtSecret(secret: unknown): asserts secret is string;
/**
 * The key both registries use for one secret. The input is chosen by the
 * consumer, never by an attacker, so no cryptographic hash is needed — and
 * `crypto.subtle` would be async where neither caller is. Two 32-bit lanes
 * with different mixing, because either one alone degenerates: measured over
 * all 857 375 three-character ASCII strings the DJB lane collides 751 775
 * times and the FNV lane never, over 2 M random 32-byte secrets each lane
 * collides ~450 times and the pair never. A collision would put two tenants
 * on one counter, silently — the price of not hashing.
 */
export declare function fingerprint(secret: string): string;
/**
 * The stable limiter for `key`. Its entry is built by `build` on the first
 * call that needs it — the first `check`, and the first after a reset.
 */
export declare function limiterFor(key: string, build: () => RateLimiter): RateLimiter;
/**
 * Empty the process-wide rate-limit counters: every in-memory limiter starts
 * over, with a fresh store, on its next check — every handler's, whenever the
 * handler was built.
 *
 * For test suites that build real handlers from a literal secret. The
 * counters are per secret and per process, not per config object, so without
 * this every test in a file after the first inherits the budget its siblings
 * spent — a `max: 1` test meets a counter that is already at 1. Call it before
 * each test (docs/AUTH.md → Testing handlers). Limiters on a persistent
 * `store` are never registered here; their counters are the store's to clear.
 */
export declare function resetRateLimiters(): void;
/**
 * Whether the repeat warning is due for this secret: `false` on the first
 * sighting and after the warning has gone out, `true` exactly once — on the
 * second sighting.
 */
export declare function repeatWarningDue(secretFingerprint: string): boolean;
/**
 * Test seam for the repeat registry — not in the package's export map. The
 * package's vitest setup file calls it before each test; a suite building
 * many bundles from one literal secret would otherwise carry the warning from
 * test to test.
 */
export declare function __resetSeenSecretsForTests(): void;