import type { GatewayAuthConfig } from '../config/schema.js';
/**
 * Resolved gateway authentication configuration.
 *
 * Supports four modes:
 * - `none`: no authentication (local dev only)
 * - `token`: Bearer token authentication (default)
 * - `password`: password-based authentication (for simpler setups)
 * - `trusted-proxy`: reverse proxy terminates auth and forwards user identity headers
 */
export interface ResolvedGatewayAuth {
    mode: 'none' | 'token' | 'password' | 'trusted-proxy';
    token?: string;
    password?: string;
    trustedProxy?: GatewayAuthConfig['trustedProxy'];
}
/**
 * Resolve gateway authentication configuration.
 * Priority: env vars > config > defaults
 */
export declare function resolveGatewayAuth(params: {
    authConfig?: GatewayAuthConfig | null;
    env?: NodeJS.ProcessEnv;
}): ResolvedGatewayAuth;
/**
 * Assert that gateway auth is properly configured.
 */
export declare function assertGatewayAuthConfigured(auth: ResolvedGatewayAuth): void;
/**
 * Validate a credential against configured auth using constant-time comparison.
 *
 * Works for both token and password modes — the caller extracts the credential
 * from the appropriate transport (header, query param, etc.).
 */
export declare function validateToken(auth: ResolvedGatewayAuth, providedCredential?: string | null): boolean;
/**
 * Extract token from request headers.
 * Supports: Authorization: Bearer <token>, X-Api-Key: <token>
 */
export declare function extractToken(headers?: Record<string, string | string[] | undefined>): string | undefined;