import type { IRequest } from '../http/Request';
import { type MiddlewareFailureResponder } from './MiddlewareFailureResponder';
import type { Middleware } from './MiddlewareStack';
import type { JwtAlgorithm } from '../security/JwtManager';
import { type NonceReplayVerifier } from '../security/NonceReplay';
export type BulletproofAuthContext = {
    strategy: 'bulletproof';
    deviceId: string;
    keyId: string;
    signedRequest: {
        timestampMs: number;
        nonce: string;
    };
};
export interface BulletproofAuthOptions {
    algorithm?: JwtAlgorithm;
    secret?: string;
    onUnauthorized?: MiddlewareFailureResponder;
    /**
     * Signed-request validity window.
     * Default: 60 seconds.
     */
    windowMs?: number;
    /**
     * Header containing the device identifier.
     * Default: x-zt-device-id
     */
    deviceIdHeader?: string;
    /**
     * Require device id header to be present.
     * Default: true
     */
    requireDeviceId?: boolean;
    /**
     * Require device id to match a claim in the JWT payload.
     * Default: true
     */
    requireDeviceClaimMatch?: boolean;
    /**
     * Claim keys to check for device binding.
     * Default: ['deviceId','device_id','did']
     */
    deviceClaimKeys?: readonly string[];
    /**
     * Optional timezone header.
     * Default: x-zt-timezone
     */
    timezoneHeader?: string;
    /**
     * Require timezone header to be present.
     * Default: false
     */
    requireTimezone?: boolean;
    /**
     * If the token contains a timezone claim, require it to match the header.
     * Default: true
     */
    requireTimezoneClaimMatch?: boolean;
    /**
     * Claim keys to check for timezone binding.
     * Default: ['tz','timezone','timeZone']
     */
    timezoneClaimKeys?: readonly string[];
    /**
     * If the token contains a user-agent hash claim, require it to match.
     * Default: true
     */
    requireUserAgentHashMatch?: boolean;
    /**
     * Claim keys to check for user-agent hash binding.
     * Default: ['uaHash','uah','userAgentHash']
     */
    userAgentHashClaimKeys?: readonly string[];
    /**
     * Provide a secret for SignedRequest verification.
     * If omitted, uses `signingSecret` (single static secret) when present.
     */
    getSecretForKeyId?: (keyId: string, req: IRequest) => string | undefined | Promise<string | undefined>;
    /**
     * Single static secret for SignedRequest verification (easy mode).
     * Can also be provided via env `BULLETPROOF_SIGNING_SECRET`.
     */
    signingSecret?: string;
    /**
     * Optional custom nonce verification hook.
     * If omitted, uses an in-memory verifier.
     */
    verifyNonce?: NonceReplayVerifier;
}
export declare const BulletproofAuthMiddleware: Readonly<{
    create(options?: BulletproofAuthOptions): Middleware;
}>;
export default BulletproofAuthMiddleware;
//# sourceMappingURL=BulletproofAuthMiddleware.d.ts.map