import { Filter, WpResponse, Service } from '../Filter';
import { MethodMeta } from '../MethodMeta';
import { AuthConfig } from '../AuthConfig';
import { JwtHook, OidcHook } from '../AuthHooks';
import { DefaultOidcVerifier } from '../DefaultOidcVerifier';
/**
 * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on every
 * route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest} in
 * RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.
 *
 * It enforces the endpoint's AuthMode from separately-bound pieces, each OPTIONAL except the OIDC
 * default:
 *  - shared-secret → constant-time compare vs the {@link AuthConfig} secret VALUE (state). No
 *                    AuthConfig bound → no accepted secret → fail fast (401).
 *  - jwt           → the bound {@link JwtHook} (`parseJwt` + `authorizeJwt`). No JwtHook bound →
 *                    "not enabled" (401): JWT needs an app secret + payload shape.
 *  - oidc          → the bound {@link OidcHook} if any, else the framework {@link DefaultOidcVerifier}
 *                    run DIRECTLY — so a server that wires NOTHING still verifies Google OIDC.
 *  - public        → BEST-EFFORT jwt parse (only if a JwtHook is bound): stamp the user's context so
 *                    a logged-out page still knows who is logged in; never fails.
 *
 * Zero wiring = OIDC just works; an app only binds the hooks it actually uses.
 */
export declare class AuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {
    private readonly oidcVerifier;
    private readonly authConfig?;
    private readonly jwtHook?;
    private readonly oidcHook?;
    constructor(oidcVerifier: DefaultOidcVerifier, authConfig?: AuthConfig | undefined, jwtHook?: JwtHook | undefined, oidcHook?: OidcHook | undefined);
    filter(meta: MethodMeta, nextFilter: Service<MethodMeta, WpResponse<unknown>>): Promise<WpResponse<unknown>>;
    private enforceJwt;
    private enforceOidc;
    /** `provided` is the Authorization bearer value — the secret itself, same header as a JWT. */
    private enforceSharedSecret;
    /** EITHER secret1 or secret2 passes — the rotation window. Constant-time on each non-empty slot. */
    private matchesEither;
    /** Parse a JWT if one is present, else do nothing — used on public routes; never throws. */
    private bestEffortJwt;
    /** Stamp the parsed user's context entries + the principal into the RequestContext. */
    private applyAuthValues;
    /**
     * The credential value IF the header carries the expected scheme, else undefined.
     *
     * Strict: a bare value with no scheme, or a value under the WRONG scheme (a shared secret sent
     * where a JWT is expected), yields undefined and the caller 401s.
     */
    private credential;
    private constantTimeEquals;
}