import type { OpsServer } from '../classes.opsserver.js';
import * as interfaces from '../../../dist_ts_interfaces/index.js';
export interface IGatewayMachineAuthContext {
    userId: string;
    isAdmin: boolean;
    token?: interfaces.data.IStoredApiToken;
    credentialId?: string;
    policy?: interfaces.data.IApiTokenPolicy;
    gatewayClient?: interfaces.data.IGatewayClient;
    managedZoneNames: string[];
}
export type TGatewayCredentialState = 'candidate' | 'active' | 'manual';
export interface IRequireGatewayMachineAuthOptions {
    allowCandidate?: boolean;
    /** Skip managed DNS-domain loading for APIs that do not evaluate hostnames. */
    loadManagedZoneNames?: boolean;
}
export declare function getGatewayCredentialState(tokenArg: interfaces.data.IStoredApiToken): TGatewayCredentialState;
export declare function normalizeGatewayHostname(hostnameArg: string): string;
export declare function normalizeGatewayTargetHost(hostArg: string): string;
export declare function isHostnameInManagedZone(hostnameArg: string, managedZoneNamesArg: string[]): boolean;
export declare function matchesGatewayHostnamePatterns(hostnameArg: string, patternsArg: string[], managedZoneNamesArg: string[]): boolean;
export declare function hasOwnedEnabledGatewayRoute(opsServerRefArg: OpsServer, authArg: IGatewayMachineAuthContext, hostnameArg: string): boolean;
export declare function requireGatewayMachineAuth(opsServerRefArg: OpsServer, requestArg: {
    identity?: interfaces.data.IIdentity;
    apiToken?: string;
}, scopeArg: 'gateway-clients:read' | 'gateway-clients:write', optionsArg?: IRequireGatewayMachineAuthOptions): Promise<IGatewayMachineAuthContext>;