import type { IncomingMessage } from "node:http";
import type { JinnConfig } from "../shared/types.js";
export declare const AUTH_COOKIE = "jinn_auth";
export declare const AUTH_DEVICE_COOKIE = "jinn_device";
export declare const LOCAL_BOOTSTRAP_GRANT_HEADER = "x-jinn-bootstrap-grant";
export declare const LOCAL_BOOTSTRAP_GRANT_TTL_MS = 60000;
export declare const PAIRING_CODE_TTL_MS: number;
export declare const AUTOMATED_AUTH_SESSION_TTL_MS: number;
export declare const AUTH_SESSION_TOUCH_THROTTLE_MS: number;
export interface PairingCodeEntry {
    expiresAt: number;
}
/**
 * Minimal store surface shared by the in-memory Map (tests, default) and the
 * durable file-backed store used in production. A plain Map satisfies it.
 */
export interface PairingCodeStore {
    get(hash: string): PairingCodeEntry | undefined;
    set(hash: string, entry: PairingCodeEntry): void;
    delete(hash: string): void;
    entries(): IterableIterator<[string, PairingCodeEntry]>;
}
/**
 * Persist pairing codes under JINN_HOME so a gateway restart within the 5-minute
 * TTL no longer silently invalidates an outstanding code. Only salted hashes and
 * expiries are stored (never the raw code), at mode 0600, and always per-instance
 * (each instance has its own JINN_HOME) — a code still only pairs the instance
 * that minted it, which is the intended boundary.
 */
export declare function createFilePairingCodeStore(jinnHome: string): PairingCodeStore;
export interface LocalBootstrapGrantEntry {
    expiresAt: number;
}
export type LocalBootstrapGrantStore = Map<string, LocalBootstrapGrantEntry>;
export type AuthSessionKind = "local" | "remote" | "token";
export interface AuthSessionDevice {
    id: string;
    name: string;
    kind: AuthSessionKind;
    createdAt: string;
    lastSeenAt: string;
    lastIp?: string;
    userAgent?: string;
}
export interface PublicAuthSessionDevice extends AuthSessionDevice {
    current: boolean;
}
export declare function createAuthToken(): string;
export declare function issueLocalBootstrapGrant(store?: LocalBootstrapGrantStore, now?: number, grantFactory?: () => string): string;
export declare function consumeLocalBootstrapGrant(rawGrant: string | undefined | null, store?: LocalBootstrapGrantStore, now?: number): boolean;
export declare function cleanupExpiredLocalBootstrapGrants(store?: LocalBootstrapGrantStore, now?: number): void;
export declare function ensureGatewayAuthToken(jinnHome: string): string;
export declare function parseCookieHeader(cookieHeader: string | undefined): Record<string, string>;
export declare function matchesGatewayAuthToken(candidate: string | undefined, expectedToken: string | undefined): boolean;
export declare function verifyGatewayAuth(headers: Record<string, string | string[] | undefined>, expectedToken: string | undefined, jinnHome?: string): boolean;
export declare function hasGatewayBearerAuth(headers: Record<string, string | string[] | undefined>, expectedToken: string | undefined): boolean;
export declare function authenticateGatewayRequest(req: Pick<IncomingMessage, "headers" | "socket">, expectedToken: string | undefined, jinnHome?: string): {
    ok: boolean;
    reason?: string;
};
export declare function isLoopbackHost(host: string | undefined): boolean;
export declare function isNetworkHost(host: string | undefined): boolean;
export declare function authRequiredForRequest(method: string | undefined, pathname: string): boolean;
export declare function shouldRequireGatewayAuth(config: Pick<JinnConfig, "gateway">): boolean;
export declare function validateGatewayExposure(config: Pick<JinnConfig, "gateway">): {
    ok: true;
} | {
    ok: false;
    error: string;
};
export declare function authCookieName(jinnHome?: string): string;
export declare function authDeviceCookieName(jinnHome?: string): string;
export declare function authCookieHeader(token: string, jinnHome?: string): string;
export declare function authDeviceCookieHeader(deviceId: string, jinnHome?: string): string;
export declare function authCookieHeaders(secret: string, deviceId: string, jinnHome?: string): string[];
export declare function clearAuthCookieHeader(jinnHome?: string): string;
export declare function clearAuthDeviceCookieHeader(jinnHome?: string): string;
export declare function clearAuthCookieHeaders(jinnHome?: string): string[];
export declare function createAuthState(config: Pick<JinnConfig, "gateway">, req: Pick<IncomingMessage, "headers" | "socket">, expectedToken: string | undefined, jinnHome?: string): {
    authRequired: boolean;
    authenticated: boolean;
    canBootstrapLocal: boolean;
    networkExposed: boolean;
    instance: string;
};
export declare function createAuthSession(jinnHome: string, req: Pick<IncomingMessage, "headers" | "socket">, opts?: {
    name?: string;
    kind?: AuthSessionKind;
    now?: number;
}): {
    secret: string;
    device: AuthSessionDevice;
};
export declare function verifyAuthSession(jinnHome: string, deviceId: string | undefined, secret: string | undefined): boolean;
export declare function touchAuthSession(jinnHome: string, req: Pick<IncomingMessage, "headers" | "socket">, now?: number): AuthSessionDevice | null;
export declare function currentAuthDeviceId(headers: Record<string, string | string[] | undefined>, jinnHome?: string): string | undefined;
export declare function listAuthSessions(jinnHome: string, currentDeviceId?: string, now?: number): PublicAuthSessionDevice[];
export declare function revokeAuthSession(jinnHome: string, deviceId: string): boolean;
export declare function normalizePairingCode(raw: string): string;
export declare function createPairingCode(): string;
export declare function issuePairingCode(store?: PairingCodeStore, now?: number, codeFactory?: () => string): {
    code: string;
    expiresAt: number;
};
export declare function consumePairingCode(store: PairingCodeStore | undefined, rawCode: string | undefined, now?: number): boolean;
export declare function cleanupExpiredPairingCodes(store?: PairingCodeStore, now?: number): void;
//# sourceMappingURL=auth.d.ts.map