export declare const BCRYPT_ROUNDS = 10;
/**
 * Generate a cryptographically random agent token (base64url). Pure — the
 * redact-by-value registry is fed at the IDENTITY-association sites in db.ts
 * (registerAgent / rotate / revoke / mintAgentToken), which key each token to its
 * owning principal so a live token is never aged out by mint volume (secret-registry).
 */
export declare function generateToken(): string;
/** Hash a token for storage. Returns bcrypt hash (includes salt). */
export declare function hashToken(token: string): string;
/** Verify a token against a stored hash. */
export declare function verifyToken(token: string, hash: string): boolean;
/** Whether the legacy grace period is active (env-driven). */
export declare function isLegacyGraceActive(): boolean;
export interface AuthResult {
    ok: boolean;
    reason?: string;
    /** The legacy-acceptance path was used (no token check). */
    legacy?: boolean;
    /**
     * v2.1 Phase 4b.1 v2: auth was rejected specifically because the target
     * row is in `revoked` state. Distinct from a generic token-mismatch so
     * callers + audit readers can distinguish "bad credential" from
     * "administratively terminated."
     */
    revoked?: boolean;
    /**
     * v2.1 Phase 4b.1 v2: auth was rejected because the target row is in
     * `recovery_pending` state. The caller must re-register with a valid
     * recovery_token obtained out-of-band from the revoker.
     */
    recoveryRequired?: boolean;
    /** The resolved caller agent name (if identified). */
    callerName?: string;
    /** The resolved caller's capabilities (JSON-parsed). */
    callerCapabilities?: string[];
}
/** v2.1 Phase 4b.1 v2: minimal shape of the row needed for auth state checks. */
export type AuthStateInput = "active" | "legacy_bootstrap" | "revoked" | "recovery_pending"
/** v2.1 Phase 4b.2: managed agent in grace window; old + new token both valid until rotation_grace_expires_at. */
 | "rotation_grace";
/**
 * v2.1 Phase 4b.2: auxiliary inputs for rotation_grace auth. Ignored for
 * every other state; required when `authState === "rotation_grace"`.
 */
export interface RotationGraceInputs {
    /** bcrypt hash of the PRE-rotation token. Auth succeeds if presented token matches this AND grace hasn't expired. */
    previousTokenHash?: string | null;
    /** ISO8601 timestamp of grace-window expiry. Auth using previousTokenHash rejected once now() >= this. */
    rotationGraceExpiresAt?: string | null;
}
/** Capability requirements per tool. Missing = always allowed. */
export declare const TOOL_CAPABILITY: Record<string, string>;
/** Tools that do NOT require any authentication (bootstrap + always-allowed-readonly). */
export declare const TOOLS_NO_AUTH: ReadonlySet<string>;
/**
 * Check if the caller's presented token authenticates them as `claimedName`.
 *
 * v2.1 Phase 4b.1 v2: auth now gates on `authState` FIRST, replacing the
 * v1 `token_hash IS NULL` overload. See types.AgentAuthState for semantics.
 *
 * @param claimedName  The agent name the caller claims to be.
 * @param tokenOrNull  The raw token presented, or null if none was sent.
 * @param storedHash   The stored bcrypt hash (null iff state=legacy_bootstrap).
 * @param authState    v2.1: explicit auth-state of the target row. Defaults to
 *                     `"active"` when not supplied (backward-compat during
 *                     pre-migration startup; once migrateSchemaToV2_1 runs,
 *                     every row carries an explicit value).
 */
export declare function authenticateAgent(claimedName: string, tokenOrNull: string | null, storedHash: string | null, authState?: AuthStateInput, graceInputs?: RotationGraceInputs): AuthResult;
//# sourceMappingURL=auth.d.ts.map