/**
 * Auth Middleware - Protect routes and WebSocket connections
 *
 * Public routes (no auth required):
 * - /api/health
 * - /api/ready
 * - /api/auth/status, /api/auth/verify
 * - /api/auth/passkeys/login-options, /api/auth/passkeys/login
 * Every other /api/auth/passkeys/* route (enroll, list, delete) needs a session.
 */
import { FastifyRequest, FastifyReply } from 'fastify';
import { IncomingMessage } from 'http';
/**
 * Persist a session token to disk so MCP servers and CLI tools
 * can piggyback on the browser's authentication.
 */
export declare function persistSessionToken(token: string): void;
/**
 * Check if a path is a public route (no session needed). Non-/api/ paths
 * (the served UI) are public too.
 */
export declare function isPublicRoute(pathname: string): boolean;
/**
 * Fastify onRequest hook for authentication
 */
export declare function authMiddleware(request: FastifyRequest, reply: FastifyReply): Promise<void>;
/**
 * WebSocket authentication middleware
 * Returns true if the connection is authenticated
 */
export declare function authWebSocketMiddleware(request: IncomingMessage): boolean;