import type { GatewayAuthConfig, GatewayTailscaleConfig } from "../config/types.gateway.js";
import type { KlawConfig } from "../config/types.klaw.js";
import { resolveGatewayAuth, type ResolvedGatewayAuth } from "./auth.js";
export { assertGatewayAuthNotKnownWeak } from "./known-weak-gateway-secrets.js";
export declare function mergeGatewayAuthConfig(base?: GatewayAuthConfig, override?: GatewayAuthConfig): GatewayAuthConfig;
export declare function mergeGatewayTailscaleConfig(base?: GatewayTailscaleConfig, override?: GatewayTailscaleConfig): GatewayTailscaleConfig;
export declare function ensureGatewayStartupAuth(params: {
    cfg: KlawConfig;
    env?: NodeJS.ProcessEnv;
    authOverride?: GatewayAuthConfig;
    tailscaleOverride?: GatewayTailscaleConfig;
    /**
     * Legacy startup option retained for external callers. Startup-generated auth
     * is runtime-only; durable auth changes must go through explicit config tools.
     */
    persist?: boolean;
    baseHash?: string;
}): Promise<{
    cfg: KlawConfig;
    auth: ReturnType<typeof resolveGatewayAuth>;
    generatedToken?: string;
    persistedGeneratedToken: boolean;
}>;
export declare function assertHooksTokenSeparateFromGatewayAuth(params: {
    cfg: KlawConfig;
    auth: ResolvedGatewayAuth;
}): void;