import type { BasicAuthConfig } from './types';
/** Parse an htpasswd file body into a `user → hash` map (last entry wins). */
export declare function parseHtpasswd(body: string): Map<string, string>;
/**
 * Resolve a {@link BasicAuthConfig} into an enforceable policy, or `undefined`
 * when no usable credentials are configured (treated as "no auth"). The htpasswd
 * file, when given, is read once here so request handling stays allocation-free.
 */
export declare function resolveAuth(cfg?: BasicAuthConfig): ResolvedAuth | undefined;
/**
 * Enforce a route's Basic auth policy against a request. Returns `undefined`
 * when the request is authorized (handling continues) or a `401` challenge
 * `Response` when it is not. ACME http-01 challenge requests are always allowed
 * so on-demand certificate issuance for a protected host still works.
 */
export declare function enforceBasicAuth(req: Request, pathname: string, auth: ResolvedAuth): Response | undefined;
/** A resolved, ready-to-enforce auth policy for one route. */
export declare interface ResolvedAuth {
  realm: string
  verify: (username: string, password: string) => boolean
}