import type { IncomingHttpHeaders, OutgoingHttpHeaders } from 'node:http';
export declare const GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = "x-xpod-admin-proxy-loopback";
export declare const GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = "x-xpod-admin-proxy-timestamp";
export declare const GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = "x-xpod-admin-proxy-signature";
export declare const GATEWAY_ADMIN_PROXY_INTENT_HEADER = "x-xpod-admin-proxy-intent";
export declare const GATEWAY_ADMIN_PROXY_NONCE_HEADER = "x-xpod-admin-proxy-nonce";
export declare const GATEWAY_ADMIN_PROXY_HEADERS: readonly ["x-xpod-admin-proxy-loopback", "x-xpod-admin-proxy-timestamp", "x-xpod-admin-proxy-signature", "x-xpod-admin-proxy-intent", "x-xpod-admin-proxy-nonce"];
export declare function createGatewayAdminProxyAuthSecret(): string;
export interface GatewayAdminProxyMarkerInput {
    secret: string;
    method: string | undefined;
    url: string | undefined;
    originalClientLoopback: boolean;
    issuedAt?: number;
    nonce?: string;
    intent?: GatewayAdminProxyIntent;
}
export interface GatewayAdminProxyMarkerVerification {
    present: boolean;
    valid: boolean;
    originalClientLoopback: boolean;
    nonce?: string;
    intent?: GatewayAdminProxyIntent;
    reason?: string;
}
export interface GatewayAdminProxyIntent {
    ownerWebId: string;
    /** Physical Pod root when it differs from the identity provider WebID root. */
    podBaseUrl?: string;
    method: 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
    resourceUrl: string;
    principalKind: 'solid-user' | 'gateway-key-verifier';
    scopes: string[];
    /** SHA-256 hex digest of a POST body. Required for POST intents. */
    bodyDigest?: string;
}
export declare function createGatewayAdminProxyHeaders(input: GatewayAdminProxyMarkerInput): OutgoingHttpHeaders;
export declare function stripGatewayAdminProxyHeaders(headers: IncomingHttpHeaders): void;
export declare function isLoopbackRemoteAddress(remoteAddress: string | undefined): boolean;
export declare function verifyGatewayAdminProxyHeaders(input: {
    headers: IncomingHttpHeaders;
    secret?: string;
    method: string | undefined;
    url: string | undefined;
    now?: number;
}): GatewayAdminProxyMarkerVerification;
export declare function canonicalGatewayAdminProxyIntent(intent: GatewayAdminProxyIntent): string;