/**
 * memory-journal-mcp — Transport-Agnostic Auth
 *
 * Authentication utilities that work across any transport layer
 * (Express, Streamable HTTP, or future transports).
 * Split from middleware.ts to keep files under ~500 lines.
 */
import type { TokenClaims } from './types.js';
import type { TokenValidator } from './token-validator.js';
/**
 * Extract a Bearer token from an Authorization header.
 */
export declare function extractBearerToken(authHeader: string | undefined): string | null;
/**
 * Transport-agnostic authenticated request context.
 * Usable by Express middleware, Streamable HTTP, or any future transport.
 */
export interface AuthenticatedContext {
    /** Whether request is authenticated */
    authenticated: boolean;
    /** Token claims (if authenticated) */
    claims?: TokenClaims;
    /** Token scopes (convenience) */
    scopes: string[];
}
/**
 * Create authentication context from an Authorization header.
 * Does not throw — returns unauthenticated context when token is missing/invalid.
 */
export declare function createAuthenticatedContext(authHeader: string | undefined, tokenValidator: TokenValidator): Promise<AuthenticatedContext>;
/**
 * Validate authentication and authorization.
 * Throws OAuth errors when token missing, invalid, or insufficient scope.
 */
export declare function validateAuth(authHeader: string | undefined, tokenValidator: TokenValidator, options?: {
    required?: boolean;
    requiredScopes?: string[];
}): Promise<AuthenticatedContext>;
/**
 * Format an OAuth error for HTTP response.
 * Transport-agnostic — returns status and body without Express dependency.
 */
export declare function formatOAuthError(error: unknown): {
    status: number;
    body: object;
};
//# sourceMappingURL=transport-agnostic.d.ts.map