/**
 * HMAC-SHA256 request signing and verification for the sync protocol.
 *
 * Provides:
 * - Canonical payload construction
 * - Request signing (client side)
 * - Request verification with replay protection (server side)
 *
 * @module domain/services/sync/SyncAuthService
 */
import type CryptoPort from '../../../ports/CryptoPort.ts';
import type LoggerPort from '../../../ports/LoggerPort.ts';
import SyncSecret from './SyncSecret.ts';
import { type SyncRateLimitConfig } from './SyncRateLimiter.ts';
export declare const SYNC_AUTH_SCHEME_HEADER = "x-warp-auth-scheme";
export declare const SHARED_SECRET_HMAC_SYNC_AUTH_SCHEME = "shared-secret-hmac-sha256";
type FailResult = {
    ok: false;
    reason: string;
    status: number;
};
type OkResult = {
    ok: true;
};
export type SyncAuthScheme = typeof SHARED_SECRET_HMAC_SYNC_AUTH_SCHEME;
/**
 * Canonicalizes a URL path for signature computation.
 */
export declare function canonicalizePath(url: string): string;
/**
 * Builds the canonical string that gets signed.
 */
export declare function buildCanonicalPayload(params: {
    authScheme?: SyncAuthScheme;
    keyId: string;
    method: string;
    path: string;
    timestamp: string;
    nonce: string;
    contentType: string;
    bodySha256: string;
}): string;
/**
 * Signs an outgoing sync request.
 */
export declare function signSyncRequest(params: {
    method: string;
    path: string;
    contentType: string;
    body: Uint8Array;
    secret: SyncSecret;
    keyId: string;
    lamport: number;
    authScheme?: SyncAuthScheme;
}, deps?: {
    crypto?: CryptoPort;
}): Promise<Record<string, string>>;
interface AuthMetrics {
    authFailCount: number;
    replayRejectCount: number;
    nonceEvictions: number;
    clockSkewRejects: number;
    malformedRejects: number;
    logOnlyPassthroughs: number;
    forbiddenWriterRejects: number;
    rateLimitRejects: number;
}
export interface SyncAuthServiceOptions {
    keys: Record<string, SyncSecret>;
    mode?: 'enforce' | 'log-only';
    nonceCapacity?: number;
    crypto?: CryptoPort;
    logger?: LoggerPort;
    allowedWriters?: string[];
    rateLimit?: SyncRateLimitConfig;
}
export default class SyncAuthService {
    private readonly _keys;
    private readonly _mode;
    private readonly _crypto;
    private readonly _logger;
    private readonly _nonceCache;
    private readonly _lastSeenLamport;
    private readonly _allowedWriters;
    private readonly _rateLimiter;
    private readonly _metrics;
    constructor(options: SyncAuthServiceOptions);
    get mode(): 'enforce' | 'log-only';
    private _validateHeaders;
    private _validateFreshness;
    private _reserveNonce;
    private _resolveKey;
    private _consumeRateLimit;
    private _verifySignature;
    verify(request: {
        method: string;
        url: string;
        headers: Record<string, string>;
        body?: Uint8Array;
    }): Promise<OkResult | FailResult>;
    verifyWriters(writerIds: string[]): OkResult | FailResult;
    enforceWriters(writerIds: string[]): OkResult | FailResult;
    private _fail;
    recordLogOnlyPassthrough(): void;
    getMetrics(): AuthMetrics;
}
export {};
