/**
 * Authentication helpers for direct-endpoint mode.
 *
 * Direct-endpoint connections (`{ provider, endpoint, config }`) may carry an
 * API key so the STT WebSocket middleware can authenticate the browser.
 * Browsers cannot set request headers on a WebSocket handshake, so only two
 * transports are available:
 *
 * - `subprotocol` (default): the key travels as an extra
 *   `Sec-WebSocket-Protocol` token, `x-api-key.<key>`. The server strips the
 *   token before the application sees it and echoes back the FIRST requested
 *   subprotocol, so the integrator's own protocols always stay in front and
 *   the key token is always appended last. A key token sent as the only
 *   subprotocol is rejected by the server (`subprotocol_companion_required`),
 *   therefore the SDK falls back to `sofya-stt.v1` as the companion token when
 *   the integrator did not configure any protocol.
 * - `query`: the key travels as the `x-api-key` query parameter of the
 *   realtime URL. Less safe, because URLs are usually recorded by proxies,
 *   gateways and browser history.
 *
 * A JWT (`{ type: "jwt", token }`) is an alternative to the API key, never a
 * complement: it travels as the FIRST subprotocol on the WebSocket, so the
 * server echoes it back, and as `Authorization: Bearer <token>` on the HTTP
 * calls the SDK makes. The integrator passes the raw JWT; the SDK adds the
 * `Bearer ` prefix itself.
 */
/** Companion subprotocol used when the integrator configured no protocols. */
export declare const DEFAULT_STT_SUBPROTOCOL = "sofya-stt.v1";
/** Prefix of the subprotocol token that carries the API key. */
export declare const API_KEY_SUBPROTOCOL_PREFIX = "x-api-key.";
/** Query parameter and HTTP header name used for the API key. */
export declare const API_KEY_PARAM = "x-api-key";
/** Close code used by the server when it rejects the API key. */
export declare const AUTH_REJECTED_CLOSE_CODE = 4401;
/** Placeholder written instead of the API key in logs and debug output. */
export declare const REDACTED_VALUE = "[redacted]";
export type ApiKeyAuthTransport = "subprotocol" | "query";
export type NoAuth = {
    type: "none";
};
export type ApiKeyAuth = {
    type: "api_key";
    key: string;
    /** Defaults to `"subprotocol"`. */
    transport?: ApiKeyAuthTransport;
};
export type JwtAuth = {
    type: "jwt";
    /**
     * The raw JWT. **Do not prefix it with `Bearer `**: the SDK adds the prefix
     * to the HTTP calls and throws `SofyaAuthError("INVALID_JWT")` if it is
     * already there.
     */
    token: string;
};
export type DirectModeAuth = NoAuth | ApiKeyAuth | JwtAuth;
export type SofyaAuthErrorCode = "INVALID_API_KEY" | "INVALID_API_KEY_CHARACTERS" | "INVALID_JWT" | "INVALID_JWT_CHARACTERS" | "AUTH_REJECTED";
/** Stable SDK error for authentication configuration and handshake failures. */
export declare class SofyaAuthError extends Error {
    readonly code: SofyaAuthErrorCode;
    readonly status: number | null;
    constructor(code: SofyaAuthErrorCode, message: string, options?: {
        status?: number | null;
    });
}
export declare const normalizeProtocols: (protocols?: string | string[]) => string[];
export declare const resolveAuthTransport: (auth?: DirectModeAuth) => ApiKeyAuthTransport;
/** Returns the API key when the connection is configured with `api_key` auth. */
export declare const getApiKey: (auth?: DirectModeAuth) => string | null;
/** Returns the JWT when the connection is configured with `jwt` auth. */
export declare const getJwt: (auth?: DirectModeAuth) => string | null;
/**
 * Validates the configured authentication before any connection is opened.
 * Throws `SofyaAuthError` with a clear message when the credential cannot be
 * used. `mode` is the session mode (`"batch"` skips the subprotocol checks).
 */
export declare const assertValidAuthConfig: (auth?: DirectModeAuth, mode?: string) => void;
/**
 * Builds the subprotocol list sent on the handshake.
 *
 * Without `api_key` auth the integrator's `protocols` are forwarded untouched
 * (including `undefined`), so existing integrations keep their exact behavior.
 */
export declare const resolveRealtimeProtocols: (protocols?: string | string[], auth?: DirectModeAuth) => string | string[] | undefined;
/** Appends `x-api-key=<key>` to the realtime URL for the `query` transport. */
export declare const applyAuthToRealtimeUrl: (url: URL, auth?: DirectModeAuth) => URL;
/**
 * Headers the SDK adds to the HTTP calls it makes (batch reprocess, audit
 * ingestion). An `x-api-key` already configured by the integrator wins.
 */
export declare const resolveAuthHeaders: (headers?: Record<string, string>, auth?: DirectModeAuth) => Record<string, string> | undefined;
/**
 * Token the SDK turns into `Authorization: Bearer <token>` on its HTTP calls:
 * `auth.token` for `jwt` auth, otherwise the deprecated `config.token`.
 */
export declare const resolveBearerToken: (auth?: DirectModeAuth, legacyToken?: string) => string | undefined;
/** Replaces the `x-api-key` query parameter value with a placeholder. */
export declare const redactUrl: (url: string) => string;
/** Replaces the API key inside subprotocol tokens with a placeholder. */
export declare const redactProtocols: (protocols?: string | string[]) => string | string[] | undefined;
/**
 * Shallow copy of a connection config safe to log: the API key, the key
 * subprotocol token and the `x-api-key` header/query value are redacted.
 */
export declare const redactAuthConfig: <T extends Record<string, any>>(config: T | null | undefined) => T | null | undefined;
//# sourceMappingURL=auth.d.ts.map