import type { IncomingMessage } from 'node:http';
import type { Authenticator, AuthResult } from '../../auth/Authenticator';
import type { AuthContext } from '../../auth/AuthContext';
import { type GatewayDeployment } from './GatewayApiKey';
import type { InvocationTokenCodec } from './InvocationTokenCodec';
export interface GatewayAccessKeyRecord {
    id: string;
    /** CSS credentials are saved configuration, never legacy Gateway authentication records. */
    kind?: 'client-credentials';
    credentialResource?: string;
    owner: string;
    secretHash: string;
    deployment: GatewayDeployment;
    scopes: string[];
    createdAt: Date;
    expiresAt?: Date;
    lastUsedAt?: Date;
    disabledAt?: Date;
    revokedAt?: Date;
    name?: string;
    plaintext?: string;
    /** CSS/OIDC client id of an issued credential; an external runtime identifier. */
    clientCredentialId?: string;
    status?: string;
    appliedTo?: string;
    appliedOn?: string;
    appliedAt?: Date;
}
export declare const LEGACY_GATEWAY_KEY_AUTHENTICATION = "legacy-gateway-key-authentication";
export type GatewayAccessKeyRepositoryInternalAccessReason = typeof LEGACY_GATEWAY_KEY_AUTHENTICATION | 'gateway-key-verifier';
export interface GatewayAccessKeyRepositoryContext {
    auth?: AuthContext;
    internalPodAccess?: {
        reason: GatewayAccessKeyRepositoryInternalAccessReason;
    };
}
export interface GatewayAccessKeyRepository {
    createKeyId?(owner: string, deployment: GatewayDeployment): string;
    create(record: GatewayAccessKeyRecord, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord>;
    findById(id: string, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord | undefined>;
    listByOwner(owner: string, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord[]>;
    setEnabled(id: string, enabled: boolean, changedAt: Date, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord | undefined>;
    revoke(id: string, revokedAt: Date, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord | undefined>;
    delete(id: string, context?: GatewayAccessKeyRepositoryContext): Promise<boolean>;
    revealPlaintext(id: string, context?: GatewayAccessKeyRepositoryContext): Promise<string | undefined>;
    touchLastUsed(id: string, lastUsedAt: Date, context?: GatewayAccessKeyRepositoryContext): Promise<void>;
}
export interface GatewayApiKeyAuthenticatorOptions {
    repository?: GatewayAccessKeyRepository;
    deployment: GatewayDeployment;
    requiredScopes?: string[];
    invocationTokenCodec?: InvocationTokenCodec;
    invocationTokenAudience?: string;
    invocationTokenIssuer?: string;
    now?: () => Date;
    maxClockSkewMs?: number;
}
export declare const DEFAULT_GATEWAY_API_KEY_SCOPES: readonly ["models:read", "inference:write"];
export declare class GatewayApiKeyAuthenticator implements Authenticator {
    private readonly repository?;
    private readonly deployment;
    private readonly requiredScopes;
    private readonly invocationTokenCodec?;
    private readonly invocationTokenAudience?;
    private readonly invocationTokenIssuer?;
    private readonly now;
    private readonly maxClockSkewMs;
    private readonly dummyHash;
    constructor(options: GatewayApiKeyAuthenticatorOptions);
    canAuthenticate(request: IncomingMessage): boolean;
    authenticate(request: IncomingMessage): Promise<AuthResult>;
    private authenticateInvocationToken;
    private validInvocationClaims;
    private readBearer;
}