/**
 * Dashboard authentication — station owner lock.
 *
 * Every /api/* endpoint (except /api/auth/{status,challenge,verify} and the
 * bunker polling endpoint) requires a Bearer token from the session store.
 * Sessions are in-memory only — cleared on server restart, stored in a Map
 * keyed by a 64-char hex token (crypto.randomBytes(32)).
 *
 * The station owner proves ownership by signing a NIP-98 challenge with the
 * pubkey matching identity.json#npub. The challenge is one-shot, 60s TTL.
 * Session TTL is 8h (overridable via NOSTR_STATION_SESSION_TTL), with a 30m
 * sliding extension on each authenticated request up to the hard cap.
 *
 * Localhost exemption: if identity.json sets requireAuth:false and the
 * request comes from 127.0.0.1 / ::1, auth is skipped. Opt-in only.
 */
import http from 'http';
export interface Session {
    token: string;
    npub: string;
    createdAt: number;
    expiresAt: number;
    userAgent: string;
}
export declare function clearAllSessions(): void;
export declare function issueChallenge(): {
    challenge: string;
    expiresAt: number;
};
export declare function consumeChallenge(challenge: string): boolean;
export declare function createSession(npub: string, userAgent: string): Session;
export declare function getSession(token: string | null): Session | null;
export declare function touchSession(token: string): void;
export declare function deleteSession(token: string): boolean;
export declare function extractBearer(req: http.IncomingMessage): string | null;
export interface VerifyInput {
    challenge: string;
    event: any;
    expectedUrl: string;
}
export interface VerifyResult {
    ok: boolean;
    error?: string;
    npub?: string;
}
export declare function verifyNip98(input: VerifyInput): VerifyResult;
export declare function isLocalhost(req: http.IncomingMessage): boolean;
export declare function localhostExempt(req: http.IncomingMessage): boolean;
export interface AuthStatus {
    configured: boolean;
    npub: string | null;
    authenticated: boolean;
    requireAuth: boolean;
    localhostExempt: boolean;
    session?: {
        createdAt: number;
        expiresAt: number;
        npub: string;
    };
}
export declare function authStatus(req: http.IncomingMessage): AuthStatus;
export declare function isPublicApi(urlPath: string): boolean;
export declare function requireSession(req: http.IncomingMessage, res: http.ServerResponse): Session | null;
export declare function expectedDashboardUrl(req: http.IncomingMessage): string;