/**
 * Auth middleware stack factory.
 *
 * Creates the standard middleware layers (origin, session, request_context,
 * bearer_auth, optional daemon_token) from configuration.
 *
 * @module
 */
import type { SessionOptions } from './session_cookie.js';
import type { AppDeps } from './deps.js';
import type { DaemonTokenState } from './daemon_token.js';
import type { RateLimiter } from '../rate_limiter.js';
import type { MiddlewareSpec } from '../http/middleware_spec.js';
/**
 * Per-factory configuration for the standard auth middleware stack.
 */
export interface AuthMiddlewareOptions {
    allowed_origins: Array<RegExp>;
    session_options: SessionOptions<string>;
    /** Path pattern for middleware (default: `'/api/*'`). */
    path?: string;
    /** Daemon token state for keeper auth. Omit to disable daemon token middleware. */
    daemon_token_state?: DaemonTokenState;
    /** Rate limiter for bearer token auth attempts (per-IP). Pass `null` to disable. */
    bearer_ip_rate_limiter: RateLimiter | null;
}
/**
 * Create the auth middleware stack.
 *
 * Returns `[origin, session, request_context, bearer_auth]` middleware specs
 * for the given path pattern. When `daemon_token_state` is provided, appends
 * a 5th `daemon_token` layer. Apps can append extra entries for non-standard
 * paths (e.g., tx's `/tx` binary endpoint).
 *
 * @param deps - stateless capabilities (keyring, db)
 * @param options - middleware configuration (allowed_origins, session_options, path, daemon_token_state)
 * @returns the middleware spec array
 */
export declare const create_auth_middleware_specs: (deps: AppDeps, options: AuthMiddlewareOptions) => Promise<Array<MiddlewareSpec>>;
//# sourceMappingURL=middleware.d.ts.map