import type { ResolvedGatewayAuth } from '../auth.js';
/**
 * Placeholder credentials that have shipped in `.env.example` or been used as
 * copy-paste examples in onboarding docs. If any of these becomes the resolved
 * gateway credential, reject it at startup. The operator almost certainly
 * copied an example file verbatim without replacing the sentinel, which would
 * otherwise leave the gateway protected by a publicly-known credential.
 */
export declare const KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS: readonly ["change-me-to-a-long-random-token", "change-me-now", "your-secret-token-here", "test-token", "my-token", "token", "secret", "password", "123456", "abc123"];
export declare function assertGatewayAuthNotKnownWeak(auth: ResolvedGatewayAuth): void;