/**
 * Token Authentication Core Module
 * Issue #331: Token authentication and HTTPS support
 *
 * CONSTRAINTS:
 * - C001: No Next.js module dependencies (next/headers, next/server, etc.)
 *   This module must be compatible with CLI build (tsconfig.cli.json)
 * - S001: Token verification uses crypto.timingSafeEqual() (timing-safe comparison)
 * - S002: AUTH_EXCLUDED_PATHS matching uses === (exact match, no startsWith)
 */
import { AUTH_COOKIE_NAME, AUTH_EXCLUDED_PATHS, parseDuration, computeExpireAt, DEFAULT_EXPIRE_DURATION_MS, isValidTokenHash } from '../../config/auth-config';
export { AUTH_COOKIE_NAME, AUTH_EXCLUDED_PATHS, parseDuration, computeExpireAt, DEFAULT_EXPIRE_DURATION_MS, isValidTokenHash };
/** Rate limiting configuration for brute-force protection */
export declare const RATE_LIMIT_CONFIG: {
    /** Maximum failed attempts before lockout */
    readonly maxAttempts: 5;
    /** Lockout duration in ms (15 minutes) */
    readonly lockoutDuration: number;
    /** Cleanup interval in ms (1 hour) */
    readonly cleanupInterval: number;
};
/** Fallback cookie maxAge in seconds when no explicit expiry is set (24 hours) */
export declare const DEFAULT_COOKIE_MAX_AGE_SECONDS: number;
/**
 * Generate a cryptographically secure random token
 * @returns 64-character hex string (32 bytes of entropy)
 */
export declare function generateToken(): string;
/**
 * Hash a token using SHA-256
 * @param token - The plain text token to hash
 * @returns 64-character hex string (SHA-256 hash)
 */
export declare function hashToken(token: string): string;
/**
 * Verify a token against the stored hash
 * S001: Uses crypto.timingSafeEqual() for timing-safe comparison
 *
 * @param token - The plain text token to verify
 * @returns true if the token is valid and not expired
 */
export declare function verifyToken(token: string): boolean;
/**
 * Parse a Cookie header string into key-value pairs
 * Used by WebSocket upgrade handler where next/headers is not available
 *
 * @param cookieHeader - Raw Cookie header string
 * @returns Parsed cookies as Record<string, string>
 */
export declare function parseCookies(cookieHeader: string): Record<string, string>;
/**
 * Check if authentication is enabled.
 * Returns true only when CM_AUTH_TOKEN_HASH is set AND passes format validation.
 * This prevents the state where auth appears enabled but login is impossible
 * (e.g., when the hash value is malformed).
 */
export declare function isAuthEnabled(): boolean;
/**
 * Calculate the Cookie maxAge in seconds (remaining token lifetime)
 * @returns maxAge in seconds, or 0 if expired/no expiry
 */
export declare function getTokenMaxAge(): number;
/**
 * Check if HTTPS is enabled based on certificate environment variable
 * @returns true if CM_HTTPS_CERT is set (indicating TLS certificates are configured)
 */
export declare function isHttpsEnabled(): boolean;
/**
 * Cookie options for authentication cookies.
 * C001: Uses only standard types (no Next.js CookieOptions dependency).
 */
export interface AuthCookieOptions {
    httpOnly: boolean;
    sameSite: 'strict';
    secure: boolean;
    maxAge: number;
    path: string;
}
/**
 * Build authentication cookie options with consistent security settings.
 * Centralizes cookie configuration to enforce HttpOnly, SameSite, and Secure flags.
 *
 * @param maxAge - Cookie max age in seconds. Use 0 to clear the cookie.
 * @returns Cookie options object compatible with Next.js response.cookies.set()
 */
export declare function buildAuthCookieOptions(maxAge: number): AuthCookieOptions;
export interface RateLimitResult {
    allowed: boolean;
    retryAfter?: number;
}
export interface RateLimiter {
    checkLimit(ip: string): RateLimitResult;
    recordFailure(ip: string): void;
    recordSuccess(ip: string): void;
    destroy(): void;
}
/**
 * Create a rate limiter for brute-force protection
 * Uses in-memory Map with periodic cleanup
 *
 * @returns RateLimiter instance with checkLimit, recordFailure, recordSuccess, destroy
 */
export declare function createRateLimiter(): RateLimiter;
//# sourceMappingURL=auth.d.ts.map