/**
 * Authentication middleware for QuantRisk MCP.
 *
 * Two code paths:
 *
 * 1. Authenticated — request carries a Bearer token in the Authorization header.
 *    The token is looked up against the UserState Durable Object.
 *    Returns { userId, email, tier, stripeCustomerId }.
 *
 * 2. Unauthenticated — no Authorization header present.
 *    Treated as a free-tier anonymous user, identified by client IP.
 *    Rate limiting still applies (via IP-keyed Durable Object lookup).
 *
 * Throws AuthError for malformed or invalid tokens.
 */
import type { UserTier } from "../services/stripe.js";
export interface AuthEnv {
    /** Durable Object namespace for UserState. */
    USER_STATE: DurableObjectNamespace;
}
export interface AuthContext {
    /** Internal user ID (same as the API key for simplicity, or a separate UUID). */
    userId: string;
    email: string | null;
    tier: UserTier;
    stripeCustomerId: string | null;
    /** True for IP-based anonymous users (no API key supplied). */
    isAnonymous: boolean;
}
/**
 * Authenticate the incoming MCP request.
 *
 * @param request  The incoming Cloudflare Workers Request.
 * @param env      Environment bindings (needs USER_STATE DO namespace).
 * @returns        Resolved AuthContext.
 * @throws         AuthError if the token is malformed or not found.
 */
export declare function authenticateRequest(request: Request, env: AuthEnv): Promise<AuthContext>;
//# sourceMappingURL=auth.d.ts.map